Hi All, had an interesting question from colleague today regarding the path mirrored traffic takes from ESX to EH when using ERSPAN.
For example, assume we have 10 ESXi hosts and all use a vds switch. We are also using a physical Extrahop device. All vm’s reside within vlan 100 and we setup ERSPAN with source = vlan 100 and destination of EH interface IP. vm1 then begins chatting with vm6 who currently live on ESX1 and ESX6 respectively. Is there a way to determine which uplinks would be used to send the mirrored traffic to the physical Extrahop device? Is it evenly distributed among ESXi hosts or does it favor an uplink from a specific ESX Host?
The concern is uplink saturation.