200GB a day

[Carter Bullard]

Hey Jonathan,
Port mirroring works pretty good up to about 80% of port speed.  Really a vendor and statistical thing. You should be fine monitoring 100 Mbps links using port mirroring with modern switches routers.

Carter

On Aug 4, 2011, at 12:08 AM, Jonathan Tripathy <jonnyt at abpni.co.uk> wrote:

> 
> On 04/08/2011 03:15, Peter Van Epp wrote:
> 
>> 
>>    Personally I prefer to run the argus sensor on its own box behind a
>> network tap so argus can not affect the production network
> 
> In my ideal scenario, I would also run argus on a separate machine, however I'm not sure I trust our network switch not to loose performance when configured with a mirror port. It would probably be fine for now (about 12Mb/s each way, so about 24Mb/s coming through the mirror port), however this isn't really a scalable solution unless I'm missing something?
>