Monitoring traffic on a HP core switch

Question

I need to monitor traffic on an HP core Switch but I never worked with HP Core before.

Does HP provide the same functionality as Remote SPAN on Cisco Switch?

Answer 1

If this is a Comware based switch then configure the following:

On the source switch:

First, configure an unused port as the reflector port, do not connect anything to this port:

interface <reflector_port_id> i.e. g1/0/1
 port link-type access

Then configure the switch to mirror traffic to a VLAN:

mirroring-group 1 remote-source
mirroring-group 1 mirroring-port <mirror_port_id> both
mirroring-group 1 reflector-port <reflector_port_id>
mirroring-group 1 remote-probe vlan <vlan_id>

• mirror_port_id should be the port where you want to collect traffic from
• reflector_port_id should be an access port with pvid 1 and no device conneceted
• Note, some switches use monitor-egress instead of reflector-port
• Note, if the source switch is configured as an IRF, all ports (mirroring, reflector) should be on the same chassis

On the destination switch:

mirroring-group 1 remote-destination
mirroring-group 1 monitor-port <monitor_port_id>
mirroring-group 1 remote-probe vlan <vlan_id>

interface <monitor_port_id>
 port link-type access
 port access vlan <vlan_id>

monitor_port_id is the port connected to Wireshark/traffic analyser

Procurve/ArubaOS uses IP/UDP encapsulation instead of VLAN to transport from source to destination

Configure the destination switch first:

mirror endpoint ip <source_ip> <source_udp_port> <dest_ip> <exit_port>

the exit port is the port connected to Wireshark/traffic analyser

Now configure the source switch:

mirror <session_id> remote ip <source_ip> <source_udp_port> <dest_ip>
interface <port_id> monitor all both mirror session <session_id>

port_id is the port being monitored

Answer 2

For Provision switches, first you define the destination (mirror) port:

mirror-port 42

and then configure the source port to be mirrored:

interface 10 monitor

You can also mirror an entire VLAN:

vlan 1 monitor

When you're done you turn mirroring off:

no mirror-port

Cisco's remote SPAN is called remote mirroring by HP. It's only supported on rather new or on larger switches: ArubaOS-Switch Software Feature Support Matrix 16.04

Answer 3

The following constraints and limitations apply to local and remote port mirroring:

1. You can create a total of four port-mirroring configurations.

2. Regardless of whether you are configuring a standalone switch or a Node group, the following limits apply:

   • There can be no more than two configurations that mirror ingress traffic. (If you configure a firewall filter to send traffic to a port mirror—that is, you use the analyzer action modifier in a filter term—this counts as an ingress mirroring configuration for switch or Node group on which the filter is applied.)
   • There can be no more than two configurations that mirror egress traffic.

3.You can configure no more than one type of output in one port-mirroring configuration. That is, you can use no more than one of the following to complete a set analyzer name output statement:

• interface
• ip-address
• vlan

4.The ratio and loss-priority options are not supported.

you should check this out -

https://www.juniper.net/documentation/en_US/junos/topics/concept/port-mirroring-qfx-series-understanding.html