A 100G leaf uplink is mirrored to a 10G sensor port — what does the IDS miss when an intruder crosses at peak?

## What a mirror session actually promises Port mirroring (SPAN, monitor sessions) tells a switch to duplicate frames seen on a set of source ports or VLANs and emit the duplicates out a destination port. Everything about that sentence is a courtesy. The switch's contract is with the *forwarding* path: production frames must go where the forwarding table says, at line rate, with the configured queueing. The mirrored copy is generated on a best-effort basis and is the first thing discarded when something is full. ## The arithmetic nobody does before ordering the sensor A 100 Gb/s leaf uplink is full duplex. Mirroring both directions offers up to 200 Gb/s of frames to the destination. A 10 Gb/s destination port can carry 10. Even if the uplink averages a modest 15% utilisation — 15 Gb/s each way, 30 Gb/s of copies — the destination is oversubscribed 3:1 and roughly two thirds of the mirrored frames are discarded before they ever leave the switch. The same arithmetic bites at the aggregation stage. A packet broker fanning several mirror sessions and taps into a handful of sensor ports adds its own oversubscription: many ingress ports, few egress ports, shallow buffers. ## Why it is silent This is the property that makes the leaf worth an interview question: - No error appears on the **source** interface. Production forwarding was never affected, so there is no CRC error, no output drop on the path the users care about. - Many platforms do not expose a counter for frames dropped by the mirror engine at all. On the ones that do, nobody is graphing it. - The **sensor** cannot see the loss either. Its own capture counters only start at its NIC; everything discarded upstream never reaches a counter it can read. A sensor reporting zero capture drops is entirely consistent with the switch having thrown away 60% of the copies. - The destination port sitting pegged at exactly line rate is usually the only visible symptom, and it looks like a healthy, well-used link. ## What a holed stream does to detection An engine that reassembles TCP streams needs the segments. With random gaps: reassembly of the affected stream fails or is abandoned; a pattern that straddles the missing bytes never matches; a connection record may still exist (the handshake got through) but with byte counts far below what actually moved, which reads like an aborted transfer rather than a gap. The dangerous version is the middle case — enough traffic arrives that the sensor looks alive and productive, and the missing fraction is invisible. ## Why the timing favours an intruder without them trying Loss is not spread evenly across the day. It appears when the fabric is busiest: the nightly backup window, month-end batch, storage replication, a large restore. That is also when bulk movement of data is unremarkable, which is exactly when an intruder staging an archive out of a database tier prefers to work. Nobody has to know about the mirror ceiling to benefit from it. So the direction of the claim matters: **no alert during the peak window proves nothing at all.** It is consistent with a quiet estate, with a rule that did not match, and with the packets never arriving. ## What you can do, and what each option costs | Option | What it buys | What it costs | | --- | --- | --- | | Mirror less, on purpose | Loss becomes *chosen* and documented instead of random | You must decide which VLANs or uplinks go uninspected, and own that decision | | Faster destination port / newer sensor NIC | Raises the ceiling | Optics, NIC, more cores to keep up with the extra traffic | | Packet broker with fan-out | One aggregation point, load-balanced across several sensors | Broker chassis, per-port licensing, sensor count multiplies | | Optical tap instead of mirror | Removes the switch's mirror engine as the constraint | Fibre re-patching, an outage window per link, and you still have to aggregate the tap's two outputs | The important framing for an interview: the first row is not a defeat. Deterministic filtering converts an unfunded, invisible, random discard into a coverage decision with a named owner. That is a strictly better position even though the sensor sees the same number of bits. ## The trap to avoid in the answer Do not reassure yourself with a five-minute average. Mirror drops happen at sub-second timescales; a destination port averaging 35% over five minutes can be at line rate for hundreds of milliseconds at a time, and every frame offered during those bursts is gone.