Hi all,
I’ve been reading up and SPAN and the use of aggregator taps and full duplex taps. I feel i have a better understanding of each, but i still have a question that cannot seem find the answer to, hopefully somebody will know the answer to this one.
When using SPAN to feed a copy of your traffic into a packet analysis tool, or an IDS for example, you need to make sure you set the SPAN session to mirror the receive and transmit channels ( RX / TX ) etc of a full duplex link. If your full duplex link is 100mbps then you must make sure that you do not exceed 50 mbps in each direction as SPAN aggregates the RX and TX into a single TX channel ( 50 + 50 ) as most NIC's do not support dual RX channels.
In such cases that you exceed this 50% figure ( e.g highly subscribed links at 80-90% ) then you use a full duplex TAP which required a dual receive NIC - which most servers don’t have.
So my question is if we have a 100mbps port we want to mirror that’s 85 % subscribed in both directions ( using source port filter not vlan filter etc ) - if we mirror the RX and TX to a destination port that is actually 1000mbps would that result in 170 mbps been mirrored to the receive channel of the IDS/server NIC without packet loss?
So conceptually, is the way to overcome this SPAN 50% utilization limitation just to use a higher speed link as your mirroring/destination port - e.g use a 1000mbps destination link rather than the same 100mbps source port link or does this just not work properly for some strange reason ?
thanks.
