Has anyone had an oversubscription problem with a SPAN destination
port, and if so, what was the bitrate?
I've seen various things that say that anything higher than 80% is
likely to drop packets.
We tend to see about 1% dropped as reported by capture_loss.log at
around 600mbit.
We'll soon be switching to either dedicated rx/tx span ports or send the
span port traffic to an etherchannel.. whichever the 6500 is more happy
with.
Ok, so I've got two boxes running different pcap programs and
monitoring the same RSPAN at different locations in the network, and
they both missed a packet at the same time. One had a pcap file
which, when measured by the size divided by the time it monitored,
managed to record 688 Mbps during the timeframe of the drop. You'd
agree with my suspicion then that we're hitting our SPAN destination
port subscription limit? I would've expected closer to 800 Mbps
before drops occurred.