Re: port mirroring + network traffic analyser

If there is much "load" here keep in mind that by definition, a single
monitoring port is effectively a simplex (term?) thing - all the
traffic being mirrored to it has to squeeze into 1Gbit/s, which means
that a single monitor port is unable to keep-up with a single
fully-loaded full-duplex GbE link. That is, if you are asking the
monitor to give you full packets. (I've no idea if that is an option
setting on monitor ports or not...and this would be independent of how
you initialized libpcap/etc on your sniffing system)

rick jones
--
I don't interest myself in "why". I think more often in terms of
"when", sometimes "where"; always "how much." - Joubert
these opinions are mine, all mine; HP might not want them anyway... :)
feel free to post, OR email to rick.jones2 in hp.com but NOT BOTH...
.