How can I perform a packet analysis on traffic flowing through a Brocade XMR, MLX, CER or CES without having to install a specific software on any of the remote endpoints ?
The best solution is to plug a computer running a packet analysis software like Wireshark to an unused port and duplicate the traffic to this port. This is called mirroring and monitoring. Here is how to do this on a Brocade MLX, XMR, CER or CES :
First configure the mirroring port. This is the port you will plug you packet analyzer,
ethe 3/1 here.
Brocade(config)# mirror-port ethernet 3/1
Next, go to a port where the traffic you want to see is flowing (here,
ethe 4/1), and specify this is a monitored port, and where you want the traffic to be sent :
Brocade(config)# interface ethernet 4/1 Brocade(config-if-4/1)# monitor ethernet 3/1 both
both can be replaced by either
output if you only want to analyze input or output traffic.
For more information, see the documentation.
If you are looking for the documentation for VDX products, see here. For ICX devices, see here.
And for Cisco IOS switches, the corresponding question is here : networkengineering.stackexchange.com/questions/640/… May 20, 2013 at 17:45
is it possible to do this for multiple devices? Say I have 10 devices I want to get traffic from, is it possible to do this using a VLAN?– elmiomarJan 10, 2020 at 16:41
With this technique you will need to configure one mirror port per device. If you want leads, look into RSPAN (for Cisco) or Arista's "TAP aggregation" feature. Apr 9, 2021 at 15:34
Mirror sessions are great, depending on your needs (you mention 'packet analysis') sFlow might also be a great fit.
check the brocade config guide (click sflow on the left -- can't figure out how to link to the specific page w/o removing navigation).
It's more or less as simple as configuring:
sflow enable sflow destination <host> <port> int x/y sflow forwarding
You don't get all the traffic (sampling) and you don't get the full packet (its truncated), but depending on your needs and what/how much you want to analyze its a pretty good fit for a lot of things. Tons of tools exist for capturing and analyzing sFlow data, that's probably a topic for another question.
Fun fact : I'm just about to configure it on a lab environment to work with pmacct.net ! And to link Brocade doc : open a link (not from the nav pane) to a new tab, and click the "Show nav" button, top-left. This should provide you a direct URL with the Nav panel. May 21, 2013 at 9:15
Here brocade.com/downloads/documents/html_product_manuals/… May 21, 2013 at 9:23
1You can use
copy-sflowin a permit statement in an inbound L3 ACL as well.– NielsJul 11, 2013 at 16:28