new software on the server, ..., almost done

[Peter Van Epp]

On Mon, Sep 10, 2007 at 01:53:58PM -0700, Michael Hornung wrote:
> The time-to-die seems random (sometimes a long time, sometimes really 
> quick) which may support a traffic-related crash theory.  I'm capturing a 
> fresh pcap (or maybe set of pcaps) to try drilling into this.  Thanks 
> Carter.
> 
> -Mike
> 

	One thing to note on span ports is that you only have half link 
bandwidth to play with. If your link is peaking at more then %50 you will
see packet loss and might see corruption because both transmit and receive
are trying to go out a single transmit port (unless you are mirroring from
gig to a 10 gig interface). In addition I've seen enough odd and unexplained 
errors (that don't appear when we insert a tap) on span ports that I don't 
really trust them. I normally use a tap for anything that I really care about 
either argus or sniffing to troubleshoot the network. I fortunatly also have 
a boss who will pay for multiport fibre taps for the core and a set of single 
port portable taps in various flavors for remote use (and for that matter
even more expensive regen taps for both our outbound links so I can have 
argus and a sniffer on the same link at the same time :-)). 

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada