1

I have the need to mirror/monitor a port on a HP A5800 AF, but to send the mirrored data for packet capturing to a host which is a virtual server.

I'm thinking of having the mirrored traffic dumped on a temporary VLAN which is in the trunk to the ESX host and add that vlan to the guest machine as secondary NIC.

From the documentation it seems I can mirror a vlan, but the "monitor" host has to be directly connected to a physical interface.

Since this is a remote datacentre I'm currently not in a condition to have a physical machine connected to the switch as recipient for the packet capture.

The switch's OS is ComWare v5.20

Any suggestion is greatly appreciated.

Thanks

Improve this question
4
  • Just a wild guess: can you connect a cable from the mirror port to a port that is tagged with the VLAN that connects back to your monitor host?
    – FelixHJ
    Jun 24, 2015 at 13:33
  • Thanks Felix, that would have been my choice if I could quickly access the datacentre. Not the case at the time.
    – b1r0
    Jun 29, 2015 at 8:35
  • If you can get someone to put do a patch at the switch, you could do a quick and dirty and run the cable from the monitor port to port in a new VLAN.
    – Stuggi
    Feb 9, 2016 at 8:18
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 11, 2017 at 17:35

1 Answer 1

Reset to default
2

You want what Cisco calls rspan. Someone put together a comparison of the ways to do this with comware, cisco, and provision: here

(switch with traffic of interest)
[Comware5]mirroring-group 1 remote-source
[Comware5]vlan 960
[Comware5]mirroring-group 1 remote-probe vlan 960
[Comware5]mirroring-group 1 mirroring-port g1/0/18 both
[Comware5]mirroring-group 1 monitor-egress g1/0/6

(switch where analyzer is connected)
[Comware52]vlan 960
[Comware52]interface g1/0/1
[Comware52-GigabitEthernet1/0/1]port link-type trunk
[Comware52-GigabitEthernet1/0/1]port trunk permit vlan 960
[Comware52]mirroring-group 1 remote-destination
[Comware52]mirroring-group 1 remote-probe vlan 960
[Comware52]mirroring-group 1 monitor-port g1/0/2

[*]display mirroring-group 1
Improve this answer
2
  • Thanks Ricky. My question was for mirroring on a single switch and yes, if I'm not mistaken, that would have been the way to go if I had the recipient "monitor-port" directly connected to the switch's port, but I needed to send the mirrored/captured packets into a VLAN not to a port. Unfortunately at the time I had access only to a guest VM and I couldn't touch the host's interface which has 50 vlan in the trunk.
    – b1r0
    Jun 29, 2015 at 8:49
  • That's exactly what that does. Mirror into a VLAN, trunk vlan to other switch(es), egress in that vlan on some other port. In theory you can span into a vlan that never leaves the switch. (I don't know if any additional encapsulation is done on the mirrored traffic.)
    – Ricky
    Jun 29, 2015 at 20:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.