I'm trying to understand how ERSPAN outputs traffic from VDS to an external physical analyzer. The main concern is the potential saturation of ESXi vds uplinks.
For example, assume we have 10 ESXi hosts all using the same vds switch. We are also using a physical device to analyze traffic. All vm’s reside within vlan 100 and ERSPAN is setup with source = vlan 100 and destination of physical analyzer IP address.
vm1 begins chatting with vm6 who currently live on ESX1 and ESX6 respectively. What uplinks would be used to send the mirrored traffic to the physical analyzer device? Is it evenly distributed among ESXi hosts or does it favor an uplink from a specific ESX Host? What happens during a busy period when there is heavy traffic? Does the mirrored traffic get dropped?
Concern is that if the uplinks were to get saturated, we would;
A) drop production traffic
or
B) drop mirrored traffic
Thanks!
