- Purple, 4500 points or more
Is there any possible way of a monitored port (source port) to stop forwarding traffic because either the destination port device was offline or crashed (like Wireshark)?
I need to set up port mirroring for Snort, but I don't know how much traffic I'm going to really see. If it overloads the box that I have it on, I don't want the source to stop sending traffic for any reason.
I suppose you plan to use span on a cisco switch for that. In that scenario source span port will continue to operate normally
no matter whether span destination is up, is connected or is running. You may even set up port mirroring without any span destination it won't impact the traffic.