Mirroring more switch ports to SPAN port that appliance is connected to results in no traffic see (4309669)

Currently, the appliance monitors a SPAN port on the switch to which one VLANs worth of traffic is mirrored.

A change was recently made to start the Foglight Experience Monitor (FxM) appliance monitoring a new set of servers.

To do this, we added a second VLAN to be mirrored to the SPAN port. Once this was done, no traffic was being captured on the FxM appliance for either the original set of servers, or the new server that was to be added.

Once the second VLAN was removed, the traffic to the original servers was restored to the appliance.

The SPAN port is overloaded with traffic, and unable to mirror it all to the appliance.

Using a Gigabyte switch as an example to explain this:

Any given port on a switch has a 1000Mbit pipe from the appliance to the switch and a 1000Mbit pipe from the switch to the appliance. In full duplex mode, traffic can be sent in both directions at the same time.

However, with a SPAN port, packets are only being sent in one direction: from switch to the appliance at 1000 Mbit. So when 1 VLAN is configured to mirror to a SPAN port, the full-duplex traffic (ie up 2000Mbit) is sent down a 1000Mbit pipe. In low volumes, the small buffering in the switch allows for this to work.

However, adding a second VLAN (now traffic total is up to 4000 Mbit) of traffic down one span port (max 1000Mbit) will almost always completely overwhelm the switchs ability to mirror the traffic, and you will see the result of no traffic being reliably transmitted to the appliance.

RESOLUTION 1:

Modify the mirroring scheme of the switch. You may be able to get to acceptable levels of traffic by not mirroring an entire VLAN, but by picking out a single server port in that VLAN to monitor which you know will capture all the traffic.

RESOLUTION 2:

Install a network tap appliance which will allow you to more reliably mirror large amounts of network traffic.

To understand how much traffic the appliance itself can properly handle (once the network infrastructure is properly configured to handle the traffic), please refer to the following solution:

Solution SOL31887- What is the maximum recommended traffic volume an appliance can monitor without becoming overloaded?https://support.quest.com/SUPPORT/index?page=solution&id=SOL31887&pmv=true