Hot Downloads

Welcome, Guest
Username: Password: Remember me

TOPIC: Cisco SPAN Port Overhead

Cisco SPAN Port Overhead 11 years 6 months ago #7546

  • TheBishop
  • TheBishop's Avatar
  • Offline
  • Moderator
  • Posts: 1719
  • Thank you received: 8
  • Karma: 5
I've got two buildings with a Cisco 2950 switch (24 x 100Mb RJ45 plus 2 x 100Mb fibre) in each. The switches are linked by two 100Mb full duplex fibres combined into an Etherchannel. I want to set up a SPAN port on the switch in the remote building so that I can sit in the local building and capture all the traffic going to/from the monitored switch port in the remote building. How much overhead will this put a) on the fabric of the switches and b) on the inter-building link? It really comes down to this question - is it okay to set up a SPAN port like this and leave it there forever as it has little impact, or is it best just to create the SPAN when you need it, use it then tear it down afterwards?
The administrator has disabled public write access.

Re: Cisco SPAN Port Overhead 11 years 6 months ago #7561

  • Chris
  • Chris's Avatar
  • Offline
  • Administrator
  • Posts: 1446
  • Thank you received: 13
  • Karma: 8
Bishop,

Monitoring specific ports on the remote switch would certainly not create much overhead for your network. The traffic captured on the monitored port is copied to what's called a 'reflector port' (a port set to loopback) which sends the data to you using a RSPAN Vlan, that is, a VLAN you have previously created for this purpose.

As such, the data is 'isolated' from the rest of the network and no harm is done. The impact on the switch's backplane is minimal, even at peak hour traffic, unless you have all ports being utilised over 70% - something that you'll never encounter on over 95% of networks, unless you happen to work for an ISP :)

The only thing to keep in mind is that you must be 'logical' on what your monitoring :idea: I wouldn't dare monitor a 100Mbit port (RSPAN Source port) from a 10Mbit port (RSPAN Destination port), because naturally, an oversubscribed destination port will result in
dropped or lost packets.

In the case now you try to monitor the ether-channel link between the two buildings - I would suggest you be careful doing so during peak hours because you'll be dealing with a 200Mbit connection effectively!

What I would also suggest, if your unix/linux skills are not rusty, is to install MRTG ( people.ee.ethz.ch/~oetiker/webtools/mrtg/ ) to help you monitor your link utilisation throughout the day - it's a great tool and works perfectly when setup correctly. I've set this up at a couple of clients and I love it!

Hope I've covered you - If you have any more questions or would like to further discuss the topic, feel free to do so!

Cheers,
Chris Partsenidis.
Founder & Editor-in-Chief
www.Firewall.cx
The administrator has disabled public write access.

SPAN 11 years 6 months ago #7571

  • TheBishop
  • TheBishop's Avatar
  • Offline
  • Moderator
  • Posts: 1719
  • Thank you received: 8
  • Karma: 5
Thanks Chris, it was just the overhead I was worried about but it sounds like that will be okay. The remote port I want to monitor is the incoming WAN connection - want to be able to have analysis access to where the WAN actually comes in - so it's unlikely to saturate a switch port
The administrator has disabled public write access.
Time to create page: 0.083 seconds

CCENT/CCNA

Cisco Routers

  • SSL WebVPN
  • Securing Routers
  • Policy Based Routing
  • Router on-a-Stick

VPN Security

  • Understand DMVPN
  • GRE/IPSec Configuration
  • Site-to-Site IPSec VPN
  • IPSec Modes

Cisco Help

  • VPN Client Windows 8
  • VPN Client Windows 7
  • CCP Display Problem
  • Cisco Support App.

Windows 2012

  • New Features
  • Licensing
  • Hyper-V / VDI
  • Install Hyper-V

Linux

  • File Permissions
  • Webmin
  • Groups - Users
  • Samba Setup