SPAN aggregation

Fri Mar 26 17:15:32 PST 2004

Gentlemen, maybe someone can help me in my quest for perfection , or,
alternatively , explain unlimited stupidity of my idea ;-)

Task - I need to collect SPAN traffic from 10 different 100Mb switches
using a single port (1GE ) sniffer. Unfortunately, switches are from
different vendors and RSPAN option is not available. Some small packet
lost is acceptable. All monitored switches are in the same location.

Solution (??) : I think to use some inexpensive 16x100Mb switch with 1GE
uplink to aggregate 10 links connected to appropriated SPAN ports of
monitored switches. All incoming 100Mb ports are mirrored to 1GE port.
My sniffer is connected to 1GE port and happily collect everything what
send by 10 monitored switches.

Questions:
1.) Am I dreaming? Is it possible at all? What about switch internal MAC
table? Is it gone crazy? What about "bridging loop"? How can I prevent
it?
2.) What inexpensive switch for aggregation you may suggest?
3.) How can I prevent mirrored traffic to be looped back to the SPAN
port? Can I disable transmit capabilities of my "aggregation" switch?
How?

Regards
Stas