Is a DoS/DDoS attack possible on a device listening on a SPAN port?

Question

Computer networks

Let me tell you right now, I'm not a networker. Therefore, the question may be quite stupid.
There is a certain complex that requires connection to the SPAN port of the core-switch of the network for its work.
Is it generally possible to flood the SPAN port with traffic so that the device can no longer cope with it?
As far as I understand mirroring technology, the question of overloading the SPAN port with traffic (and, as a result, any device connected to it) does not make sense at all. You can mirror only a pre-hardware-defined stream, or generally only one port. Is it so? I ask for a detailed answer if possible.
Second question. again, if I understand everything correctly, you can only mirror roughly port-to-port (well, or a group of ports, it doesn’t matter), How can we then see all the traffic that goes through the switch? Obviously we can't see the whole answer. Then what is the point at all, if we can miss something important?

Answer 1

Is a DoS/DDoS attack possible on a device listening on a SPAN port?

Attack is possible on anything. Another question is how effective it will be.

Is it possible in principle to flood the SPAN port with traffic so that the device can no longer cope with it?

It is difficult to give an answer without specifying which device is in question. In general, if you connected to a gigabit port, and the device processes 1.5 million frames per second, then there is hope for its stable operation.

As far as I understand mirroring technology, the question of overloading the SPAN port with traffic (and, as a result, any device connected to it) does not make sense at all

A SPAN port (in the role of destination) will not be able to pass more traffic than is physically possible (this limit is set by the medium speed and buffer sizes). Example - you are copying traffic from 3 ports (each loaded at 400 Mbps on average) to one gigabit (1000 Mbps) port. Approximately one sixth of the traffic (3 * 400 Mbps - 1000 Mbps = 200 Mbps) you will lose.

because You can mirror only a pre-hardware-defined stream, or generally only one port.

As a rule, you can copy traffic from a port (sometimes with filtering by vlan), a group of ports, from a vlan to another port.

Then what is the point at all, if we can miss something important?

Often, for example, through SPAN they monitor the traffic coming to the processor. An increase in the volume of such traffic, as a rule, does not bode well.

How can we then see all the traffic that goes through the switch?

If I were implementing a similar project now (i.e. it is necessary to see "all" traffic), I would pay attention to Gigamon products (if there is a lot of money) or experiment with passive optical splitters (it is logical to install them on links with the traffic we are interested in) .
In short, it is not clear what problem you are trying to solve. If you describe it, it will be possible to speak more specifically.

Answer 2

Good evening. Thanks for the detailed explanations. The task is to implement the IDS system. hence all the questions. those. how will this IDS system respond to incidents if there is a theoretical possibility of a packet drop due to an overload on the SPAN port that this system is listening to?