Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm in the process of setting up a network security lab and want to monitor all packets leaving and entering the network. I'll get a 2Gbit/sec uplink as a channel terminated on a CISCO 3750 switch and a /24, the other end is a 6500 which is being run in production. Now I have a machine with two 1Gbit/sec NICs and want to use it to log the traffic with minimal changes to the 6500 which our network depends on.

What is the best way in terms of network structure to do this?

I thought of using SPAN on the 3750 side to mirror the traffic to my packet logger. But this means the system would not run in our datacenter.

I thought of using only 1Gbit/sec and setting the system up as a bridge, but this would put another throughput/latency penalty on the link.

I'm kind of anxious to create the SPAN on the 6500 because the concerning CISCO document says it would increase the load (which is a no-go).

Am I missing something here? Any other suggestions? Maybe use the system as a router for the /24? But then I'd be stuck with 1Gbit/sec.

share|improve this question
Maybe visit back through your previous questions and accept some answers first. – Chris Thorpe Apr 16 '11 at 11:15
What does "all packets entering & leaving the network" mean, exactly? On a network of any size if you SPAN all VLANs, for instance, total traffic may easily exceed 2 Gbit/sec. And how fast will your archival storage fill up--or accept writes? On the other hand, if you need 2Gbs to monitor your Internet link...can I share it? – Paul Apr 17 '11 at 18:02

When you say that you want to monitor all traffic entering or exiting your network I assume you're referring to internet traffic and not intranet traffic, right? If so, you could look at setting up Netflow on the interface that is the ingress/egress for your network and export the flow data to a Netflow collector.

share|improve this answer
I need raw tcpdump dumps for archival. – leto Apr 16 '11 at 14:52

I've run span successfully on a Cat6k with Sup720. There's also a handy option called RSPAN which encapsulates SPAN packets in a UDP frame and lets them send them to a machine elsewhere in the network.

You don't mention how much active traffic you have on the link you want to capture.

Full tcpdumps for achival will quickly fill up.

Do the math: 100Mbps is 12.5MBps is 45GB/hour or roughly 1TB/day.

Stripping out unwanted information asap will be key.

Turn on span during off hours and see how your CPU load changes.

I believe you can also SPAN only traffic matching certain profiles (eg, only port 80)

If you have some money to spend, you can get yourself an ethernet Tap. Here's one from Blackbox that does 10/100/1000. (you didn't specify what type of interconnect you were using,)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.