[ale] Etherreal and switches

[cfowler at outpostsentinel.com (Christopher Fowler)]

On Thu, 2006-09-28 at 10:54 -0400, Jim Popovitch wrote:
> 
> You won't be able to see traffic that doesn't pass through the first
> XL.
> So if someone telnet's from the lab to the demo boxes you won't see
> their traffic (but you might see their DNS/PTR queries if DNS servers
> are hanging off of the first XL)
> 
> The only way to achieve this is to have all systems use a default
> route
> that is a device off the first XL, or to add another SPAN port on the
> second XL.
> 

Is I config port 23 as a span port for the 2nd XL should I plug that
port into port 22 of the first so that port 23 of the first shows me
traffic for both?

> Are you looking to monitor RTP streams? 
> 

I'm just going to count packets and monitor bandwidth.  The idea is to
alert when bandwidth usage it high across the network.