[Bro] SPAN oversubscription
Justin Azoff
JAzoff at albany.edu
Tue Jul 17 08:48:46 PDT 2012
On Tue, Jul 17, 2012 at 10:16:52AM -0500, Martin Holste wrote:
> Has anyone had an oversubscription problem with a SPAN destination
> port, and if so, what was the bitrate?
I've seen various things that say that anything higher than 80% is
likely to drop packets.
We tend to see about 1% dropped as reported by capture_loss.log at
around 600mbit.
We'll soon be switching to either dedicated rx/tx span ports or send the
span port traffic to an etherchannel.. whichever the 6500 is more happy
with.
--
-- Justin Azoff
-- Network Security & Performance Analyst
More information about the Bro
mailing list