[Bro] SPAN oversubscription

Justin Azoff JAzoff at albany.edu
Tue Jul 17 08:48:46 PDT 2012

On Tue, Jul 17, 2012 at 10:16:52AM -0500, Martin Holste wrote:
> Has anyone had an oversubscription problem with a SPAN destination
> port, and if so, what was the bitrate?

I've seen various things that say that anything higher than 80% is
likely to drop packets.

We tend to see about 1% dropped as reported by capture_loss.log at
around 600mbit.

We'll soon be switching to either dedicated rx/tx span ports or send the
span port traffic to an etherchannel.. whichever the 6500 is more happy

-- Justin Azoff
-- Network Security & Performance Analyst

More information about the Bro mailing list