> A managed Ethernet switch allows you to configure a monitor port. This
> works pretty well, but does not always forward all packets to the forward
> port (on some switches, especially under load).
I.e., one reason for switched Ethernet is to allow more than (10Mb,
100Mb, 1Gb) of total traffic to go over a network segment, by realizing
that most Ethernet traffic is point-to-point and, as such, doesn't have
to go to all hosts, and making an "Ethernet" consist of a switch fabric
with more than the Ethernet's bandwidth, and sending point-to-point
traffic only to the port with a host with the given MAC address plugged
into it.
(MAC addresses for a port are, I think, typically detected by the switch
looking for traffic *from* the port and taking the source address from
that traffic.)
This means that you might have more traffic going through a switch than
can be sent out any particular port on the switch.
(I don't know whether any switches handle multicast traffic cleverly
rather than just sending it to all ports; I guess if you're watching
lots of multicast pr0n^H^H^H^Hmulti-media streaming presentations on
your network, much, perhaps most, of your Ethernet traffic would be
multicast rather than unicast, so the switched Ethernet trick would work
only for switches that figure out which ports have hosts plugged into
them with particular multicast addresses.)
