[127520] in North American Network Operators' Group
Re: SPANS Vs Taps
daemon@ATHENA.MIT.EDU (Darren Bolding)
Thu Jul 1 19:25:10 2010
In-Reply-To: <EFBFF5360F0AA044AC59D2198E5EE4AA02D5BE78@EXCHANGEBE.iso-ne.com>
Date: Thu, 1 Jul 2010 16:24:38 -0700
From: Darren Bolding <darren@bolding.org>
To: "Bein, Matthew" <mbein@iso-ne.com>
Cc: nanog@nanog.org
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
Tap manufactures will be sure to tell you of many issues.
The main concern I would have is that it is possible for a switch to drop
frames of a SPAN. Your decision might be influenced based on your
application and the impact of such errors (billing, lawful intercept,
forensics).
A tap vendors take: http://www.networkcritical.com/What-are-Network-Taps
On a somewhat related note, I will mention that TNAPI from ntop is quite
handy. http://www.ntop.org/TNAPI.html
<http://www.networkcritical.com/What-are-Network-Taps>--D
On Thu, Jul 1, 2010 at 1:48 PM, Bein, Matthew <mbein@iso-ne.com> wrote:
> As I was doing a design today. I found that I had a bunch of 100 MB
> connections that I was going to bring into a aggregation tap. Then I was
> thinking, why don't I use a switch like a Cisco 3560 to gain more
> density. Anyone run into this? Any down falls with using a switch to
> aggregate instead of a true port aggregator??
>
>
>
> Regards,
>
>
>
> Matthew
>
>
--
-- Darren Bolding --
-- darren@bolding.org --
