port spanning entire networks

[jhaggett]

Hi there,

I have a question regarding port spanning. I have a 2900XL and a few 2950's, and I was wondering what effects spanning an entire swith to one monitoring port would be. How would you approach sniffing a network for a baseline? Should I monitor just the server ports and uplink ports?

Thanks!

[skarundi]

Port monitoring, if configured correctly, doesn't affect the performance of the switch or network.

First, clearly define what your reasons are for the monitoring, then I think you will be able to decide exactly what you should monitor.

Also please explain what you mean by "sniffing a network for a baseline" ?

[jhaggett]

Hi Skarundi,

Basically what I would be looking to do, over a period of a week or so, do random captures of the entire network to see what the load is across then LAN segment, and what devices chat to other devices most frequently. I would be using Sniffer to compliment the Catalyst Management Suite.

[skarundi]

You could span each vlan, one vlan at a time, on the core switch.

[jhaggett]

Hi Skarundi,

We only have one VLAN actually.

[lnguye]

This "entire VLAN in a port" solution would work if the load of the entire network at any point in time is not excedding the bandwidth capacity of the destination port. If the aggregate bandwidth exceeds the SPANned destination port, it would drop the excess packets on the way to your collector device. Also, I think if the SPANning is on the same VLAN, you may see the packet twice on the destination port: one when the packet enters the source port and one more time when it it is sent to other port in the same VLAN. Check it out.

[james.irwin]

If you are capturing an entire VLAN to one port, you will most likely drop tons of packets and you will not be able to get an accurate idea of the load.

I think there are much better ways to baseline and monitor switch and network performance than to use a sniffer. I use Fluke's Network Inspector or Solarwinds tools, which are SNMP-based and pull stats from each device. Fluke also makes nice reports and charts.

[blazesod]

Hi,

Have you looked at IOS command netflow?

R/S

Dave