VLAN Puzzle

---

schumaku wrote:

Port mirroring (aka SPAN ports, which can be local or even remote in a different end if the network!) can be an effective helpers, but often easy hit their limits.. A good collection of reasons is there -> https://www.gigamon.com/resources/resource-library/white-paper/to-tap-or-to-span/

---

This article is "spot on".  Put another way, "the devil is in the details."

None of the three methods I described will capture a full out gigabit data stream that is active in both directions:

The Throwing Star functions by clamping the connection rate to 100Mbps and using power from the devices being monitored to drive the two 100Mbps taps (one for each direction).  So, "keeping up" is not a concern, but the data rate is compromised.

The Datacomm captures gigabit in both directions, but outputs only a single gigabit connection to the monitor.  So, if the total data in both directions exceeds about 920Mbps, then it will lose packets.

Mirroring to a single port suffers from the same issue.  If both transmit and receive are constantly over a half gigabit, then it will fall behind.  The inexpensive TP-Link switch I used for this exercise allows only one "mirror port".  However, the two situations where I needed a tap both fell well under the switch capability:

• Tapping my 350Mbps ISP feed was "no problem". The total bandwidth was significantly under the switch capacity.
• For this "wired satellite" experiment, there was very little actual data traffic across the connection, so the switch was easily able to keep up.