1

I've got some questions about my port mirroring configuration. I'm working with alcatel omniswitch.

After configuring port mirroring my destination port is loosing network connection and it can't communicate with other computers which are sources. I guess that's normal, but my question is - can I do something to enable network and communication with other PCs? Because I have to check bandwidth of network and influence of programme on network, and also it would be nice to have possibility to connect to network to do some other things through destination computer.

Thanks in advance for replies.

Improve this question

1 Answer 1

Reset to default
1

Typically, if you need to use the host that is the target of a mirror, then you need a separate network connection for that. The connection used for the mirror is going to be overwhelmed with all the traffic it is mirroring, and it will become practically useless as a regular host interface.

You should install a second NIC in the host and use that to receive the mirrored traffic, then you can use the original NIC on a different switch interface as a regular host interface. You may even have trouble doing that, depending on the available host resources (CPU, RAM, disk, application, etc.). The entire host could be bogged down and slow because of all the mirrored traffic.

I have to check bandwidth of network

You know the bandwidth of the connections. Most PCs today have a 10/100/1000 Mbps interface, and if your switch is a gigabit switch, then the bandwidth will be 1 Gbps, a 100 Mbps switch will give each a 100 Mbps bandwidth. The switch may have a faster uplink interface, but the bandwidth on a connection does not change.

Improve this answer
5
  • Thank you very much for quick answer. The one more thing I would like to know is if I can somehow test impact on the network of ids working on target host? (Test it between target and source hosts or sth like that)
    – luqson7
    Nov 9, 2019 at 2:24
  • I'm not really sure what you are asking. Let's say you have a 24-port gigabit switch, and 20 of those ports are sending at 1 Gbps, for a total of 20 Gbps. The mirror port can only send 1 Gbps to the mirror target. That means you are losing 95% of your traffic that never makes it to the mirror target, but the link to the mirror target is completely saturated with mirror traffic, so it will, for all practical purposes, be useless for normal PC traffic.
    – Ron Maupin ♦
    Nov 9, 2019 at 2:30
  • Well, my task is to find, if ids running at destination port will affect somehow network speed and mainly - if target device (rpi) will be able to handle few PCs with it's traffic (using e.g. iperf). Do you have any clue how could I do it?
    – luqson7
    Nov 9, 2019 at 3:08
  • That is really a different question that belongs in a new question. You seem to have stubled into asking an X-Y question. Also, the question in your comment is very broad (overly-broad questions, questions that seek primarily opinion-based answers, and those requesting recommendations will be closed), so you want to give as much detail as possible when you ask it. You can refer to the Network Engineering Question Checklist for guidance.
    – Ron Maupin ♦
    Nov 9, 2019 at 3:13
  • @luqson7, remember to ask about the actual problem you want to solve, not how to implement the solution you have devised because it may not be the way to solve the actual problem.
    – Ron Maupin ♦
    Nov 9, 2019 at 3:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.