Re: OT: SPAN/port mirroring 10gig links

T
he 6748, and maybe the 6716, has a Janus ASIC that has a replication limit
of around 19.2 Gbps. Each time you SPAN a port on ingress, the Janus has to
make an additional replication. If you have a single ingress SPAN, that
will double the load on the chip, which already lowers your available
throughput on ingress to less than line rate. It's something to be aware
of. If you overload the Janus, you'll have packet loss that is very
difficult to find unless you know how to find it.

On Fri, Aug 30, 2013 at 8:53 PM, Dennis Worth <dennis.worth_at_gmail.com>wrote:

> 6500's with Sup720b's and WS-X6716-10GE's
>
> i was thinking originally x6748-GE's,
>
>
> Dennis Worth
> On Aug 30, 2013 7:29 PM, "John Neiberger" <jneiberger_at_gmail.com> wrote:
>
>> What hardware are you talking about?
>>
>>
>> On Fri, Aug 30, 2013 at 3:50 PM, Dennis Worth <dennis.worth_at_gmail.com>wrote:
>>
>>> Hi group,
>>>
>>> I am faced with mirroring a ton of data on 10gig links for security
>>> purposes. We are talking about terabytes of data daily, and my concern is
>>> the overhead of CPU and ASIC's. Before I go and just throw it in I
>>> thought
>>> i would ask for any experiences anyone has come across. I know SPAN
>>> source
>>> ports are limited, so I want to keep that into account and filter as much
>>> as I don't want to see, but that appears to very little if none at all.
>>>
>>> This is a security project using RSA Security Analytics and Imperva.
>>>
>>> As always your feedback is highly appreciated.
>>>
>>> thank you,
>>>
>>> --
>>> Dennis Worth
>>>
>>>
>>> Blogs and organic groups at http://www.ccie.net
>>>
>>> _______________________________________________________________________
>>> Subscription information may be found at:
>>> http://www.groupstudy.com/list/CCIELab.html

Blogs and organic groups at http://www.ccie.net
Received on Fri Aug 30 2013 - 21:55:44 ART