How do I manage dropped packets?

Monitoring and security tools need complete packet data to properly analysis the task at hand. If a threat is missed because of incomplete data, the solution has failed. Your options to provide these packets are spanning a port from your switch or utilizing a network TAP.

SPAN ports are commonly known to drop packets if a port is oversubscribed. The issue arises when the total amount of traffic aggregated from the source ports exceeds the physical limitations of the destination port, it results in some dropped packets on the destination port.

This does not cause any switch performance degradation or disruption or traffic flow on the source ports. The only affected port is the destination port, and it drops packets on a first in first out (FIFO) basis once the egress buffer limit is exceeded.

• Monitoring tools may miss packets due to SPAN port over-subscription

• SPAN will not pass corrupt packets or errors (bad packets) and are dropped