[Bro] SPAN oversubscription

[Martin Holste]

Ok, so I've got two boxes running different pcap programs and
monitoring the same RSPAN at different locations in the network, and
they both missed a packet at the same time.  One had a pcap file
which, when measured by the size divided by the time it monitored,
managed to record 688 Mbps during the timeframe of the drop.  You'd
agree with my suspicion then that we're hitting our SPAN destination
port subscription limit?  I would've expected closer to 800 Mbps
before drops occurred.

On Tue, Jul 17, 2012 at 10:48 AM, Justin Azoff <JAzoff at albany.edu> wrote:
> On Tue, Jul 17, 2012 at 10:16:52AM -0500, Martin Holste wrote:
>> Has anyone had an oversubscription problem with a SPAN destination
>> port, and if so, what was the bitrate?
>
> I've seen various things that say that anything higher than 80% is
> likely to drop packets.
>
> We tend to see about 1% dropped as reported by capture_loss.log at
> around 600mbit.
>
> We'll soon be switching to either dedicated rx/tx span ports or send the
> span port traffic to an etherchannel.. whichever the 6500 is more happy
> with.
>
> --
> -- Justin Azoff
> -- Network Security & Performance Analyst