Re: OT: SPAN/port mirroring 10gig links

Why not make use of a network tap. You can check this out:
http://www.networkinstruments.com/products/ntaps/index.php?tab=optical

+234.805.664.8600

On Sat, Aug 31, 2013 at 5:10 AM, Dennis Worth <dennis.worth_at_gmail.com>wrote:

> Thanks John. That's what I was afraid of.
>
> Dennis Worth
> On Aug 30, 2013 8:56 PM, "John Neiberger" <jneiberger_at_gmail.com> wrote:
>
> > T
> > he 6748, and maybe the 6716, has a Janus ASIC that has a replication
> limit
> > of around 19.2 Gbps. Each time you SPAN a port on ingress, the Janus has
> to
> > make an additional replication. If you have a single ingress SPAN, that
> > will double the load on the chip, which already lowers your available
> > throughput on ingress to less than line rate. It's something to be aware
> > of. If you overload the Janus, you'll have packet loss that is very
> > difficult to find unless you know how to find it.
> >
> >
> > On Fri, Aug 30, 2013 at 8:53 PM, Dennis Worth <dennis.worth_at_gmail.com
> >wrote:
> >
> >> 6500's with Sup720b's and WS-X6716-10GE's
> >>
> >> i was thinking originally x6748-GE's,
> >>
> >>
> >> Dennis Worth
> >> On Aug 30, 2013 7:29 PM, "John Neiberger" <jneiberger_at_gmail.com> wrote:
> >>
> >>> What hardware are you talking about?
> >>>
> >>>
> >>> On Fri, Aug 30, 2013 at 3:50 PM, Dennis Worth <dennis.worth_at_gmail.com
> >wrote:
> >>>
> >>>> Hi group,
> >>>>
> >>>> I am faced with mirroring a ton of data on 10gig links for security
> >>>> purposes. We are talking about terabytes of data daily, and my concern
> >>>> is
> >>>> the overhead of CPU and ASIC's. Before I go and just throw it in I
> >>>> thought
> >>>> i would ask for any experiences anyone has come across. I know SPAN
> >>>> source
> >>>> ports are limited, so I want to keep that into account and filter as
> >>>> much
> >>>> as I don't want to see, but that appears to very little if none at
> all.
> >>>>
> >>>> This is a security project using RSA Security Analytics and Imperva.
> >>>>
> >>>> As always your feedback is highly appreciated.
> >>>>
> >>>> thank you,
> >>>>
> >>>> --
> >>>> Dennis Worth
> >>>>
> >>>>
> >>>> Blogs and organic groups at http://www.ccie.net
> >>>>
> >>>>
> _______________________________________________________________________
> >>>> Subscription information may be found at:
> >>>> http://www.groupstudy.com/list/CCIELab.html
>
>
> Blogs and organic groups at http://www.ccie.net
>
> _______________________________________________________________________
> Subscription information may be found at:
> http://www.groupstudy.com/list/CCIELab.html

Blogs and organic groups at http://www.ccie.net
Received on Sat Aug 31 2013 - 05:19:44 ART