2

When sampling a mirrored port of a switch, is there any means of determining the switch-port information of the packet?

Since Ethernet packets do not contain this information, I assume the answer is no, as is supported by my experiments.

  • Is this in any way possible, even for a particular switch brand, possibly via some extension that still emits a stream of "pcapabble" packets on the mirrored port?

The reason I am asking is in order to detect subtle source spoofing, at most two flaps.

  • You're mirroring multiple ports and want to find out the original ingress port? No, I don't think that's possible with mirroring. Have you looked at sFlow? – Zac67 Apr 21 at 14:05
  • @Zac67 Precisely. – fundagain Apr 21 at 14:23
  • REgarding sFlow: I need all the packets, or at least all the headers, sFlow samples – fundagain Apr 21 at 14:26
  • 1
    Sure - just an idea. How about pinning the MACs to their ports, making spoofing attempts useless? – Zac67 Apr 21 at 14:49
  • 1
    Are you mirroring a specific port? If so you know the mirrored traffic frames either came in/out that port OR it was a broadcast. – Criggie Apr 21 at 21:39
3

No.

Ethernet switches are transparent devices, so they do not alter the ethernet frames (except to add and remove 802.1Q tags for trunks). There is nothing in the ethernet frame header that supports what you ask, and a switch does not add anything, making it look like the source host is directly communicating with the destination host on a dedicated link.

The best you could do is to have some application or tool on your capture device that tries to match the source MAC addresses on frames with what is in the switch MAC address table, but that is something you would need to come up with on your own.


You could use the various methods to prevent the spoofing in the first place. For example, DHCP snooping with Dynamic ARP Inspection and IP Source Guard. You can also use 802.1X.

0

When sampling a mirrored port of a switch, is there any means of determining the switch-port information of the packet?

Not directly. The mirror process will copy the frame as it saw it to the mirror-output port. Nothing in the original frame will indicate the port it was on. (unless you know the switch's internal mac address table.)

The way several commercial products do this Voodoo(tm) is through VLAN tagging. If the source port(s) are in different VLANs, and the switch tags mirror output frames, you can tell the origin based on the tag. Granted, that's hard to replicate on a normal traffic-passing switch. (every port in it's own VLAN is an unusual configuration)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.