OT: SPAN/port mirroring 10gig links

Hi group,

I am faced with mirroring a ton of data on 10gig links for security
purposes. We are talking about terabytes of data daily, and my concern is
the overhead of CPU and ASIC's. Before I go and just throw it in I thought
i would ask for any experiences anyone has come across. I know SPAN source
ports are limited, so I want to keep that into account and filter as much
as I don't want to see, but that appears to very little if none at all.

This is a security project using RSA Security Analytics and Imperva.

As always your feedback is highly appreciated.

thank you,

-- 
Dennis Worth
Blogs and organic groups at http://www.ccie.net