Using SPAN on a Catalyst 3524/3548 and the effect on switch resources.

[msamycia]

Has any one experienced any problems on the Catalyst 3524/3548 switches when running a continual SPAN session monitoring a lot of ports? Specifically have you experienced any impact on the switches resources and ability to forward traffic?

[bsivasub]

Check this out

http://www.cisco.com/warp/public/473/41.html#archXL

[MickPhelps]

I have had first hand experience with SPAN on the 2900xl and 3500 switches that degrade performance.

Since it was a production environment, I couldn't do the testing required to isolate the exact cause, however, I do know that port mirroring was to blame.

Issue: on a 2900xl and 3500 switch (the 3500 replaced the 2900xl as a test), packets were being dropped (ignored) on the uplink and downlink interfaces. This switch was the egress point of the customer's network. If I remember correctly, the switch passed approx 2000pps through the uplink and downlink ports. As high as 10% packet loss due to Ignores were being measured. All switch ports were SPANed to a port connected to and IDS and another port connected to a profiler.

The profiler port was 10M half-duplex

When port mirroring was turned off on all ports except ingress/egress, the issue was fixed.

I don't know if it was the 10M half-duplex port that caused the congestion, or if it was the fact that all ports were being monitored.

Mick.

[rfroom]

The Catalyst 2900XL/3500XL use a shared buffer memory. If there sufficient traffic amount of SPAN traffic destined for the 10 Mb, half-duplex in excess of 10 Mb, it could cause the shared buffers to fill up and cause packet loss elsewhere.

This would only be the case if excessively more than 10 Mb of traffic was trying to go out the 10 mb port.

See the following link for more info:

http://www.cisco.com/warp/customer/473/19.html#5