2960 - Performance overhead due to SPAN

[Junglistposse]

Hi

Looking to SPAN all traffic on a 2960 switch to a single port to dump it into NTOP. 

Are there likely to be any performance issues on a 2960 due to SPANning?

I found quite a nice article on the 6500 series that says

On the Catalyst 5500/5000 and 6500/6000 Series Switches, a packet that is received on a port is transmitted on the internal switching bus. Every line card in the switch starts to store this packet in internal buffers. At the same time, the Encoded Address Recognition Logic (EARL) receives the header of the packet and computes a result index. EARL sends the result index to all the line cards via the result bus. The knowledge of this index allows the line card to decide individually whether it should flush or transmit the packet as the line card receives the packet in its buffers.

Is this the same for the 2960?

Also,... i'm going to have too much traffic to SPAN everything to a 1GB port... do people have experience of SPANning to a 10GB port on a 2960?

[Mark Malone · Accepted solution]

Hi

6500 is completely different architecture than the 2960 theres no EARL  , I have spanned vlans plenty of times on 2960s without any issues so you should be fine , there access switchs only so i persume theres no filers or servers connected and its just spanning standard application traffic off pcs and other end user devices, if thats the case your fine, keep an eye on your cpu ...show proc cpu sorted | ex 0.00 , havent spanned to a 10gb port on them but they operate just the same but there usually  kept for uplinks to other switches , 29s are low end switches , ANUE systems would be a better option but there very expensive 100k , there built specifically for SPAN collections of traffic

[Richard Burts]

If the intent is to span all ports to a single span port then I would be concerned about overloading the span port. We do not know how many ports are on this switch and do not know how busy the ports are and both factors could impact whether you are overloading the span port.

HTH

Rick

[Junglistposse]

perfect thanks! specifically re no EARL architecture in 2960 switches :)