Re: OT: SPAN/port mirroring 10gig links

Thanks John. That's what I was afraid of.

Dennis Worth
On Aug 30, 2013 8:56 PM, "John Neiberger" <jneiberger_at_gmail.com> wrote:

> T
> he 6748, and maybe the 6716, has a Janus ASIC that has a replication limit
> of around 19.2 Gbps. Each time you SPAN a port on ingress, the Janus has to
> make an additional replication. If you have a single ingress SPAN, that
> will double the load on the chip, which already lowers your available
> throughput on ingress to less than line rate. It's something to be aware
> of. If you overload the Janus, you'll have packet loss that is very
> difficult to find unless you know how to find it.
>
>
> On Fri, Aug 30, 2013 at 8:53 PM, Dennis Worth <dennis.worth_at_gmail.com>wrote:
>
>> 6500's with Sup720b's and WS-X6716-10GE's
>>
>> i was thinking originally x6748-GE's,
>>
>>
>> Dennis Worth
>> On Aug 30, 2013 7:29 PM, "John Neiberger" <jneiberger_at_gmail.com> wrote:
>>
>>> What hardware are you talking about?
>>>
>>>
>>> On Fri, Aug 30, 2013 at 3:50 PM, Dennis Worth <dennis.worth_at_gmail.com>wrote:
>>>
>>>> Hi group,
>>>>
>>>> I am faced with mirroring a ton of data on 10gig links for security
>>>> purposes. We are talking about terabytes of data daily, and my concern
>>>> is
>>>> the overhead of CPU and ASIC's. Before I go and just throw it in I
>>>> thought
>>>> i would ask for any experiences anyone has come across. I know SPAN
>>>> source
>>>> ports are limited, so I want to keep that into account and filter as
>>>> much
>>>> as I don't want to see, but that appears to very little if none at all.
>>>>
>>>> This is a security project using RSA Security Analytics and Imperva.
>>>>
>>>> As always your feedback is highly appreciated.
>>>>
>>>> thank you,
>>>>
>>>> --
>>>> Dennis Worth
>>>>
>>>>
>>>> Blogs and organic groups at http://www.ccie.net
>>>>
>>>> _______________________________________________________________________
>>>> Subscription information may be found at:
>>>> http://www.groupstudy.com/list/CCIELab.html

Blogs and organic groups at http://www.ccie.net
Received on Fri Aug 30 2013 - 21:10:07 ART