Re: OT: SPAN/port mirroring 10gig links

Segun

it did cross my mind. Just wanted to avoid more hardware and rack space,
but I may have to to get enough span outs total for the design.

Thanks for tip

Dennis Worth
On Aug 30, 2013 9:20 PM, "Segun Daini" <segundaini_at_gmail.com> wrote:

> Why not make use of a network tap. You can check this out:
> http://www.networkinstruments.com/products/ntaps/index.php?tab=optical
>
>
>
> +234.805.664.8600
>
>
> On Sat, Aug 31, 2013 at 5:10 AM, Dennis Worth <dennis.worth_at_gmail.com>wrote:
>
>> Thanks John. That's what I was afraid of.
>>
>> Dennis Worth
>> On Aug 30, 2013 8:56 PM, "John Neiberger" <jneiberger_at_gmail.com> wrote:
>>
>> > T
>> > he 6748, and maybe the 6716, has a Janus ASIC that has a replication
>> limit
>> > of around 19.2 Gbps. Each time you SPAN a port on ingress, the Janus
>> has to
>> > make an additional replication. If you have a single ingress SPAN, that
>> > will double the load on the chip, which already lowers your available
>> > throughput on ingress to less than line rate. It's something to be aware
>> > of. If you overload the Janus, you'll have packet loss that is very
>> > difficult to find unless you know how to find it.
>> >
>> >
>> > On Fri, Aug 30, 2013 at 8:53 PM, Dennis Worth <dennis.worth_at_gmail.com
>> >wrote:
>> >
>> >> 6500's with Sup720b's and WS-X6716-10GE's
>> >>
>> >> i was thinking originally x6748-GE's,
>> >>
>> >>
>> >> Dennis Worth
>> >> On Aug 30, 2013 7:29 PM, "John Neiberger" <jneiberger_at_gmail.com>
>> wrote:
>> >>
>> >>> What hardware are you talking about?
>> >>>
>> >>>
>> >>> On Fri, Aug 30, 2013 at 3:50 PM, Dennis Worth <dennis.worth_at_gmail.com
>> >wrote:
>> >>>
>> >>>> Hi group,
>> >>>>
>> >>>> I am faced with mirroring a ton of data on 10gig links for security
>> >>>> purposes. We are talking about terabytes of data daily, and my
>> concern
>> >>>> is
>> >>>> the overhead of CPU and ASIC's. Before I go and just throw it in I
>> >>>> thought
>> >>>> i would ask for any experiences anyone has come across. I know SPAN
>> >>>> source
>> >>>> ports are limited, so I want to keep that into account and filter as
>> >>>> much
>> >>>> as I don't want to see, but that appears to very little if none at
>> all.
>> >>>>
>> >>>> This is a security project using RSA Security Analytics and Imperva.
>> >>>>
>> >>>> As always your feedback is highly appreciated.
>> >>>>
>> >>>> thank you,
>> >>>>
>> >>>> --
>> >>>> Dennis Worth
>> >>>>
>> >>>>
>> >>>> Blogs and organic groups at http://www.ccie.net
>> >>>>
>> >>>>
>> _______________________________________________________________________
>> >>>> Subscription information may be found at:
>> >>>> http://www.groupstudy.com/list/CCIELab.html
>>
>>
>> Blogs and organic groups at http://www.ccie.net
>>
>> _______________________________________________________________________
>> Subscription information may be found at:
>> http://www.groupstudy.com/list/CCIELab.html

Blogs and organic groups at http://www.ccie.net
Received on Fri Aug 30 2013 - 21:25:32 ART