200GB a day

[Jonathan Tripathy]

On 04/08/2011 03:15, Peter Van Epp wrote:

>
> 	Personally I prefer to run the argus sensor on its own box behind a
> network tap so argus can not affect the production network

In my ideal scenario, I would also run argus on a separate machine, 
however I'm not sure I trust our network switch not to loose performance 
when configured with a mirror port. It would probably be fine for now 
(about 12Mb/s each way, so about 24Mb/s coming through the mirror port), 
however this isn't really a scalable solution unless I'm missing something?