Toggle Menu
White Papers
Duplicate packets of monitoring data can come from several sources, including the use of SPAN ports and the geographic location of the data captures. For instance, a normally configured SPAN port (which is frequently used to connect monitoring tools to the network) can generate multiple copies of the same packet (see Figure 1). This is because SPAN ports on a network switch are usually configured to copy ingress and egress data from every switch data port. The SPAN port output to a network monitoring tool includes duplicate copies of every packet that goes into and then out of the switch which means multiple copies of packets are being sent to the SPAN port for every data port being used on that network switch. These copies are exact duplicates of the original packet. Even when optimally configured, a SPAN port may generate between one and four copies of a packet. The duplicate packets can represent as much as 50% of the network traffic being sent to a monitoring tool.
It also matters where you capture monitoring data. If you capture it at the ingress and then again in the core, you may have copied the same data twice, unless you selectively screened the data at the time of data capture. This double capture is in addition to whatever duplicates were made by the core switches themselves.
×
Please have a salesperson contact me.
*Indicates required field
Thank you.
A sales representative will contact you soon.
