Jakub Wartak schrieb: >> I am sniffing the traffic from a port which mirrors the port which the >> router is bound to, so I think I am monitoring both sides of all the >> traffic generated by the router, is it correct? > > It should be correct, but some switches allow to mirror for example only rx > or > tx or both sides of some ethernet ports - therefore i'm asking..
And if you are monitoring both directions you have to make sure that either the monitored port is never more than 50% busy, or the mirroring port has to have at least double the bandwidth as the monitored port, as the traffic of both directions has to go out in one direction. Cheers, Sven -- Sven Anderson Institute for Informatics - http://www.ifi.informatik.uni-goettingen.de Georg-August-Universitaet Goettingen Lotzestr. 16-18, 37083 Goettingen, Germany _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists
