Traffic on the network is in load sharing on 2 switches. Each of the switches will be configured with mirroring of a number of network interfaces to an analysis port (mirror port). I need to capture the full traffic of both analysis ports to disk, but only have a laptop with one NIC. Can I just connect a hub to both analysis ports and my laptop or do I need a special aggregation tap or so? Aggregated traffic volume is low and not an issue, nor for the interfaces nor for the laptop (SSD)

Thanks in advance for advice

  • 1
    What is your switch model? Some can capture to a VLAN that can cross switches. – Ron Maupin Jan 16 '18 at 23:41
  • Depending on the model of switch it's also possible to mirror one port on switch A to a port on switch B and then mirror both this port and the source port on switch B to a third port on switch B which then connects to your analyzer port (laptop). – rnxrx Jan 17 '18 at 4:54
  • No, a "hub" (assuming you have a true hub) will just be a mess of collisions. You need multiple NICs, or an arrangement of cascaded mirror ports, or hardware specifically designed for this. – Ricky Jan 17 '18 at 4:57
  • Plus, a repeater hub can only handle 100 Mbit/s at maximum, so gigabit traffic will be mostly dropped. – Zac67 Jan 17 '18 at 11:52
  • Switches will just do simple port mirroring, nothing "more". Not so much because of lack of functionality but because they are business critical and my client does not want to implement configuration that is unknown to him (or it would take a lengthy procedure with lab testing etc). Traffic load is not the issue. Seems clear a hub is a bad idea. Any suggestions for dedicated hardware? Expensive? – EddieM Jan 17 '18 at 12:10

If you connect a repeater hub to the monitor ports you create a network loop. STP will block one port, without STP your network might go down. If the monitor ports are egress only, a switch would be a better solution (see 3.) as it could keep up with the data rate much better.

Roughly, there are four solutions:

  1. As Ron has pointed out, RSPAN or similar captures traffic into a VLAN that can be routed from one switch to the other and then to the laptop. This is the clean solution.
  2. You use the interconnect port as monitor port from the first switch (risking high data rates and frame drops on the interconnect) and connect the laptop to the second switch's monitor port.
  3. You use a third, small switch that connects to both monitor ports and combines them. Both monitor ports need to be configured to drop all incoming traffic (per ACL or egress-only mode).
  4. The interconnect ports are used as monitor ports and a third switch is connected in between, mirroring one of its interconnect ports to the monitor port with the laptop (assuming mirroring captures both directions).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.