I'm in the process of setting up a network security lab and want to monitor all packets leaving and entering the network. I'll get a 2Gbit/sec uplink as a channel terminated on a CISCO 3750 switch and a /24, the other end is a 6500 which is being run in production. Now I have a machine with two 1Gbit/sec NICs and want to use it to log the traffic with minimal changes to the 6500 which our network depends on.
What is the best way in terms of network structure to do this?
I thought of using SPAN on the 3750 side to mirror the traffic to my packet logger. But this means the system would not run in our datacenter.
I thought of using only 1Gbit/sec and setting the system up as a bridge, but this would put another throughput/latency penalty on the link.
I'm kind of anxious to create the SPAN on the 6500 because the concerning CISCO document says it would increase the load (which is a no-go).
Am I missing something here? Any other suggestions? Maybe use the system as a router for the /24? But then I'd be stuck with 1Gbit/sec.