Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
I am a little lost with regards to the concept of capturing every traffic passing a core switch. If we set our monitor source to be all VLANs in a L3 switch, does that mean that traffic coming from a routed port destined to go out another routed port will not be captured? Would specifying every active interface be a better way?
Thank you.
It is specific to the configuration design and the equipment in question. Traffic mirror/monitor is implemented differently on different platforms so without specific hardware and configuration it is impossible to say for sure.
However, generally if you use a VLAN or all VLANs as a source then any traffic tagged with those VLANs should be copied into the monitored traffic, including any traffic to an SVI for that VLAN.
Traffic that is forwarded through a router and not delivered to/sourced from devices connected to ports that accept/send traffic tagged with the specified VLANs would not be monitored/mirrored because it would never be tagged with the VLANs specified. You can specify multiple sources in monitoring/mirroring on many devices so you can simply cover all the bases by specifying the VLANs and any Layer 3 configured physical interfaces that may no participate in VLAN tagged traffic. If you cannot specify both VLANs and physical Layer 3 routed ports at the same time, you can simply run 2 monitoring sessions, or do only physical interfaces which should capture most of the interesting traffic for most cases.
