1

I need to monitor traffic on an HP core Switch but I never worked with HP Core before.

Does HP provide the same functionality as Remote SPAN on Cisco Switch?

2
  • 3
    You need to provide the switch model and ideally software version. Not all switches provide this functionality. – JFL Sep 5 '17 at 13:35
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Feb 21 '18 at 16:27
2

If this is a Comware based switch then configure the following:

On the source switch:

First, configure an unused port as the reflector port, do not connect anything to this port:

interface <reflector_port_id> i.e. g1/0/1
 port link-type access

Then configure the switch to mirror traffic to a VLAN:

mirroring-group 1 remote-source
mirroring-group 1 mirroring-port <mirror_port_id> both
mirroring-group 1 reflector-port <reflector_port_id>
mirroring-group 1 remote-probe vlan <vlan_id>
  • mirror_port_id should be the port where you want to collect traffic from
  • reflector_port_id should be an access port with pvid 1 and no device conneceted
  • Note, some switches use monitor-egress instead of reflector-port
  • Note, if the source switch is configured as an IRF, all ports (mirroring, reflector) should be on the same chassis

On the destination switch:

mirroring-group 1 remote-destination
mirroring-group 1 monitor-port <monitor_port_id>
mirroring-group 1 remote-probe vlan <vlan_id>

interface <monitor_port_id>
 port link-type access
 port access vlan <vlan_id>

monitor_port_id is the port connected to Wireshark/traffic analyser

Procurve/ArubaOS uses IP/UDP encapsulation instead of VLAN to transport from source to destination

Configure the destination switch first:

mirror endpoint ip <source_ip> <source_udp_port> <dest_ip> <exit_port>

the exit port is the port connected to Wireshark/traffic analyser

Now configure the source switch:

mirror <session_id> remote ip <source_ip> <source_udp_port> <dest_ip>
interface <port_id> monitor all both mirror session <session_id>

port_id is the port being monitored

0

For Provision switches, first you define the destination (mirror) port:

mirror-port 42

and then configure the source port to be mirrored:

interface 10 monitor

You can also mirror an entire VLAN:

vlan 1 monitor

When you're done you turn mirroring off:

no mirror-port

Cisco's remote SPAN is called remote mirroring by HP. It's only supported on rather new or on larger switches: ArubaOS-Switch Software Feature Support Matrix 16.04

1
  • 1
    It seems the OP is looking for remote SPAN. – JFL Sep 5 '17 at 18:08
-3

The following constraints and limitations apply to local and remote port mirroring:

  1. You can create a total of four port-mirroring configurations.
  2. Regardless of whether you are configuring a standalone switch or a Node group, the following limits apply:

    • There can be no more than two configurations that mirror ingress traffic. (If you configure a firewall filter to send traffic to a port mirror—that is, you use the analyzer action modifier in a filter term—this counts as an ingress mirroring configuration for switch or Node group on which the filter is applied.)
    • There can be no more than two configurations that mirror egress traffic.

3.You can configure no more than one type of output in one port-mirroring configuration. That is, you can use no more than one of the following to complete a set analyzer name output statement:

  • interface
  • ip-address
  • vlan

4.The ratio and loss-priority options are not supported.

you should check this out -

https://www.juniper.net/documentation/en_US/junos/topics/concept/port-mirroring-qfx-series-understanding.html

1
  • 2
    You are referring to Juniper documentation while the question is about Hewlett-Packard devices... – JFL Sep 12 '17 at 10:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.