Cisco SPANs have not been the best solution for us in forwarding traffic to the AMD. Especially, since any one conversation can traverse 3 (or more vlans). The NPB receives multiple duplicates of the same packets. Even with de-dup on the NPB, the AMD is reporting large percentage of retransmissions and sequence number gaps. Therefore, we are researching alternative capture points. TAPs is a possibility. However, we are also investigating configuring our VMWare host distributed vswitches for port mirroring.
This article explains East-West traffic capture, and is for DCRUM 12.4. We are going to perform North-South traffic capture, and are using DCRUM 2017.
Has anyone seen an updated version of this page for DCRUM 2017?
Also, anyone have best practice solutions for this issue?
Thanks and God bless,