How can I perform a packet analysis on traffic flowing through a Brocade XMR, MLX, CER or CES without having to install a specific software on any of the remote endpoints ?


The best solution is to plug a computer running a packet analysis software like Wireshark to an unused port and duplicate the traffic to this port. This is called mirroring and monitoring. Here is how to do this on a Brocade MLX, XMR, CER or CES :

First configure the mirroring port. This is the port you will plug you packet analyzer, ethe 3/1 here.

Brocade(config)# mirror-port ethernet 3/1

Next, go to a port where the traffic you want to see is flowing (here, ethe 4/1), and specify this is a monitored port, and where you want the traffic to be sent :

Brocade(config)# interface ethernet 4/1
Brocade(config-if-4/1)# monitor ethernet 3/1 both

Note : both can be replaced by either input or output if you only want to analyze input or output traffic.

For more information, see the documentation.

If you are looking for the documentation for VDX products, see here. For ICX devices, see here.

  • And for Cisco IOS switches, the corresponding question is here : networkengineering.stackexchange.com/questions/640/… May 20 '13 at 17:45
  • is it possible to do this for multiple devices? Say I have 10 devices I want to get traffic from, is it possible to do this using a VLAN?
    – elmiomar
    Jan 10 '20 at 16:41
  • With this technique you will need to configure one mirror port per device. If you want leads, look into RSPAN (for Cisco) or Arista's "TAP aggregation" feature. Apr 9 at 15:34

Mirror sessions are great, depending on your needs (you mention 'packet analysis') sFlow might also be a great fit.

check the brocade config guide (click sflow on the left -- can't figure out how to link to the specific page w/o removing navigation).

It's more or less as simple as configuring:

sflow enable
sflow destination <host> <port>
int x/y
sflow forwarding

You don't get all the traffic (sampling) and you don't get the full packet (its truncated), but depending on your needs and what/how much you want to analyze its a pretty good fit for a lot of things. Tons of tools exist for capturing and analyzing sFlow data, that's probably a topic for another question.

  • Fun fact : I'm just about to configure it on a lab environment to work with pmacct.net ! And to link Brocade doc : open a link (not from the nav pane) to a new tab, and click the "Show nav" button, top-left. This should provide you a direct URL with the Nav panel. May 21 '13 at 9:15
  • 1
    You can use copy-sflow in a permit statement in an inbound L3 ACL as well.
    – Niels
    Jul 11 '13 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.