[PLUG] help with switches

Larry Brigman larry.brigman at gmail.com
Tue Feb 6 06:14:19 UTC 2007


On 2/5/07, Dan Young <danielmyoung at gmail.com> wrote:
> On 2/5/07, Jason Martin <nsxfreddy at gmail.com> wrote:
> > If you don't do a setup like this, you're banking on the various links
> > being monitored never being saturated beyond the half-duplex send
> > buffer of the switch monitor port.  This isn't a great gamble, since
> > Ethernet traffic (and TCP/IP traffic in general) tends to be fairly
> > bursty.
>
> If you're monitoring that much traffic and you're not the NSA, do you
> really need every packet? Just do sflow/netflow/cflow/*flow.
>

To analyze and solve some problems, yes you do.



More information about the PLUG mailing list