[PLUG] help with switches

[Dan Young]

On 2/5/07, Jason Martin <nsxfreddy at gmail.com> wrote:
> If you don't do a setup like this, you're banking on the various links
> being monitored never being saturated beyond the half-duplex send
> buffer of the switch monitor port.  This isn't a great gamble, since
> Ethernet traffic (and TCP/IP traffic in general) tends to be fairly
> bursty.

If you're monitoring that much traffic and you're not the NSA, do you
really need every packet? Just do sflow/netflow/cflow/*flow.

-- 
Dan