I have some 200 servers connected to my L3 switch. I am planning to SPAN for every server to one Sniffer. Is it technically viable? what are the possible challenges I might face ?
Where is the SPAN destination located. Are you planning to do a local SPAN or a remote SPAN. SPAN is done in hardware so you can do it. You might just be hiiting the hardware limitation on the switch. With Local SPAN, you can create only 2 sessions and a maxiumum of 128 SPAN sources with Release 12.2(18)SXE and later.
Please read the doc below for all the restrictions before going ahead :
Should not be a problem. But again it depends on the hardware how it behaves with such a huge traffic. As it is done in hardware, we beleive that you will be absolutely fine with it.
