Wireless Access

We currently have a 10 gig port-channel setup on our 7240 controllers , we setup a port mirroring from one of the indiviual trunks of the port-channel (Aruba doesn't support port mirroring on a port-channel) and performed a packet caputure using Wireshark to stop capturing after 1 minute when completed the capture file was 1.4 Gigs.

At the same time we performed a port mirroring on the uplink switch ( Cisco doesn't allow you mirror an interface/port that is one of the members of a port-channel) which is reverse to what Aruba allows , the only option left was to do the port mirroring from the port-channel . Ran the packet capture using Wireshark to stop after 1 minute and when completed the capture file was 500 Megs.

My question is : When the Aruba controller does the conversion (Integration Service)  from 802.11 removes the 802.11 header/trailer and encase it in a 802.3 frame , will you see a reduction in the amount of traffic on the other end once the frames are converted to 802.3 (Cisco uplink/ethernet) compare to the traffic seen before it gets converted over. 

I am going to guess that it's not a 60+% overhead of 802.11 to 802.3. I will tell you though in a past life, belonging to a security group for one of the largst fortune 500 companies, as the guy who did the session mirrors, taps, etc for our IDS stuff, that I found ANY captures from a cisco port-channel mirror to be highly suspect, and it may be the same on Aruba gear. The ONLY captures I 100% trusted were from network taps that  could mirror ANYTHING at the PHY layer to the monitor port. Sometimes the mirror includes frames and packets on one vendor's hardware that anoter vendor drops (even though it should be a per packet copy no matter what). 

When running them at the same time, were all other factors equal (ala the receiver was 10g or at least fast enoguh to receive the stream) and was set to the same phy layer speed and duplex? Not really sure, but I am guessing the 802.3 frames are not 60+% smaller than 802.11 :)