Question:
Does a SPAN session copy packets that get "output dropped" due to queuing? I believe it does.
Scenario:
Shoretel Voice Switch Appliances Keep Crashing every few weeks, no obvious reason.
Only related item is that vendor says Shoretel logs say "2,234 packets lost from Director" before each crash (for example, number always different). The appliance does not support native packet capture itself unfortunately.
Indeed, we find output drops on switchports connected to voice switches. Interestingly, output drops don't seem to increment, except at the time of the crashes.
Anyway, adjust QoS to try to resolve output drops. Per vendor-request, also start SPAN/packet capture of said switchports so that during next crash, we see which packets are lost. I don't believe this will work, because I believe SPAN session "packet copy" takes place first, then the packets are dispatched to their destined output queue and dropped.
I believe the only way to know which packets are lost due to output queue drop is to insert a hub inline between the Shoretel switch and the Cisco switch, and capture there. At the same time, continue doing the capture from the SPAN session. Then, compare the two once Output Drops are detected. Am I correct?
