8

How can I perform a packet analysis on traffic flowing through a Brocade XMR, MLX, CER or CES without having to install a specific software on any of the remote endpoints ?

2 Answers 2

8

The best solution is to plug a computer running a packet analysis software like Wireshark to an unused port and duplicate the traffic to this port. This is called mirroring and monitoring. Here is how to do this on a Brocade MLX, XMR, CER or CES :

First configure the mirroring port. This is the port you will plug you packet analyzer, ethe 3/1 here.

Brocade(config)# mirror-port ethernet 3/1

Next, go to a port where the traffic you want to see is flowing (here, ethe 4/1), and specify this is a monitored port, and where you want the traffic to be sent :

Brocade(config)# interface ethernet 4/1
Brocade(config-if-4/1)# monitor ethernet 3/1 both

Note : both can be replaced by either input or output if you only want to analyze input or output traffic.

For more information, see the documentation.

If you are looking for the documentation for VDX products, see here. For ICX devices, see here.

3
  • And for Cisco IOS switches, the corresponding question is here : networkengineering.stackexchange.com/questions/640/… Commented May 20, 2013 at 17:45
  • is it possible to do this for multiple devices? Say I have 10 devices I want to get traffic from, is it possible to do this using a VLAN?
    – elmiomar
    Commented Jan 10, 2020 at 16:41
  • With this technique you will need to configure one mirror port per device. If you want leads, look into RSPAN (for Cisco) or Arista's "TAP aggregation" feature. Commented Apr 9, 2021 at 15:34
3

Mirror sessions are great, depending on your needs (you mention 'packet analysis') sFlow might also be a great fit.

check the brocade config guide (click sflow on the left -- can't figure out how to link to the specific page w/o removing navigation).

It's more or less as simple as configuring:

sflow enable
sflow destination <host> <port>
int x/y
sflow forwarding

You don't get all the traffic (sampling) and you don't get the full packet (its truncated), but depending on your needs and what/how much you want to analyze its a pretty good fit for a lot of things. Tons of tools exist for capturing and analyzing sFlow data, that's probably a topic for another question.

3
  • Fun fact : I'm just about to configure it on a lab environment to work with pmacct.net ! And to link Brocade doc : open a link (not from the nav pane) to a new tab, and click the "Show nav" button, top-left. This should provide you a direct URL with the Nav panel. Commented May 21, 2013 at 9:15
  • 1
    You can use copy-sflow in a permit statement in an inbound L3 ACL as well.
    – Niels
    Commented Jul 11, 2013 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.