Bandwidth Limitations

[anthonysgroi]

My current configuration is two CAT 6500's with 1 IDSM installed in each monitoring different VLAN's through SPAN. My question is what happens when there is say "too much" traffic? traffic is not qued is it? or is it left alone to pass. I dont want to introduce any latency/bottlenecks to the network. I cant seem to find any documents on how they react to situations like this. Any help would be great thank you.

[a.kiprawih · Accepted solution]

Normally, if the monitored network traffic/stream is high and beyond the SPAN capability, other traffic will just flow through, not kept in queue and subsequently delayed the traffic flow.

This is a nature of SPAN where it will only capture a snapshot of passing traffic, and this works fine in conjunction with IDSM's promiscuous mode that monitor traffic in passive mode.

Passive mode cannot drop packets to block a network intrusion attempt, but can send TCP resets to both sides of the network connection to try to break the connection.

http://www.cisco.com/en/US/partner/products/hw/vpndevc/ps4077/products_configuration_guide_chapter09186a008055df92.html#wp1067335

HTH

AK

[anthonysgroi]

Ok thank you very much but that link isnt working for me.

[a.kiprawih]

Sorry, try this one:

http://www.cisco.com/en/US/products/hw/vpndevc/ps4077/products_configuration_guide_chapter09186a008055df92.html#wp1067335

HTH

AK

[anthonysgroi]

Thank you.