1. Introduction, Setting

1-31

[Multi-VLAN Sensor] Since VLAN packets outside the monitoring target are also observed from the trunk port to which the sensor-dedicated port is connected, an unregistered sensor warning is generated.

If the switch's trunk port cannot be configured to allow input/output for only specific VLAN IDs, you can use the packet filtering function of the Multi-VLAN Sensor to monitor only the network of the specified VLAN ID.

Specifically, register the multiple VLAN IDs to be monitored using the following procedure, and then restart the sensor.

(1) Log in to the Multi-VLAN Sensor's Web UI and open the "Sensor Configuration" → "Packet Filter" page.
(2) In the "Network Filter (ACCEPT)" field of the interface used for terminal monitoring (such as eth0, em1, etc.), enter the VLAN ID information in the following format.

0.0.0.0/0.0.0.0,<VLAN-ID number>​​​​​​​

(3) Click the "Save" button to save the settings.
(4) Restart the Multi-VLAN Sensor.

Please note that applying this configuration will disable monitoring of IPv6 address usage on the corresponding interface.

Example: To monitor only the networks with VLAN IDs 50, 60, 70, 80, 90, and 100, enter the following six lines in the “Network Filter (ACCEPT)” field.

0.0.0.0/0.0.0.0,50
0.0.0.0/0.0.0.0,60
0.0.0.0/0.0.0.0,70
0.0.0.0/0.0.0.0,80
0.0.0.0/0.0.0.0,90
0.0.0.0/0.0.0.0,100