Network monitoring

摘要

Network devices, systems, and methods are described that cause a particular port on a first network device to send data packets from the particular port on the first network device to an intrusion system (IS) on a second network device.

主权项

1. A network device, comprising:
a processor; a memory in communication with the processor; a network chip having a number of network ports for the network device and having access to the processor and memory; and computer executable instructions storable in the memory and executable by the processor to receive instructions from a threat mitigation engine (TME) in response to the TME detecting suspicious data traffic at the network device, wherein the instructions received from the TME are to instruct the network device to identify a particular port among the number of network ports of the network device as having the suspicious data traffic and to provide data packets from the particular port of the network device to an intrusion system (IS) on a second network device to allow the IS to determine whether an actual data traffic anomaly is occurring at the particular port of the network device, and wherein the TME is on a server.