To begin with, the switch will give lesser priority to mirrored traffic. CPU overhead for copying and mirroring a single packet is negligible, but those expenses mount up over time. As a result, each mirrored packet is given less priority than normal network traffic by the switch.. Low-to-medium traffic times aren’t affected by this. For both standard and mirror traffic, this switch is more than capable of handling it all. However, things might get a little tense as traffic begins to build up. Mirrored packets will be dropped first by the switch. As a result, you’re more likely to lose network observability at a moment when you need it the least.
Another drawback of port mirroring is that it consumes resources on both real and virtual machines. These can be expensive in terms of both hardware and software license. Therefore, in most circumstances, port mirroring may be implemented only at certain places within the network.
Host-based monitoring agents that output packet capture information obtained on servers and open source proxy servers can be used to create a cloud-friendly and scalable approach.