cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
600
Views
5
Helpful
2
Replies

Question on RSPAN vlan saturation

Eric Hansen
Level 1
Level 1

I am in the process of creating a RSPAN vlan that I am going to put several servers and a full time packet Sniffer into ( Infinistream ), this is my first time using a RSPAN vlan and I am curious what side effects the switch will experience if I over subscribe the links going back to the Sniffer? Right now I am looking at about 100 servers that aren't too chatty going to 4 gig Ethernet links in one etherchannel back to the Sniffer.

At this point I am not to concerned if I saturate those links and drop packets. What I am concerned about is if it will start to beat up the switches CPU, memory, or general ability to route/switch packets. The switch in question is a 6509 w/vss 12.2(33)sxh. I'm pretty sure we will just drop packets but I wanted to be sure. If we do drop packets that's ok, the Sniffer can be scaled to include more ports to compensate as time goes on.

thanks

e-

2 Replies 2

Giuseppe Larosa
Hall of Fame
Hall of Fame

Hello Eric,

we had bad experience even with local span oversubscription with 12.2.(18)SXF14 with cpu going very high and losting forwarding/routing capacity.

In our case we had almost 3 Gbps of internet traffic pushed towards a 1GE destination port.

Hope to help

Giuseppe

Ok good to know, i'll keep a close eye on it.

Thanks.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco