I am a little lost with regards to the concept of capturing every traffic passing a core switch. If we set our monitor source to be all VLANs in a L3 switch, does that mean that traffic coming from a routed port destined to go out another routed port will not be captured? Would specifying every active interface be a better way?

Thank you.

1 Answer 1


It is specific to the configuration design and the equipment in question. Traffic mirror/monitor is implemented differently on different platforms so without specific hardware and configuration it is impossible to say for sure.

However, generally if you use a VLAN or all VLANs as a source then any traffic tagged with those VLANs should be copied into the monitored traffic, including any traffic to an SVI for that VLAN.

Traffic that is forwarded through a router and not delivered to/sourced from devices connected to ports that accept/send traffic tagged with the specified VLANs would not be monitored/mirrored because it would never be tagged with the VLANs specified. You can specify multiple sources in monitoring/mirroring on many devices so you can simply cover all the bases by specifying the VLANs and any Layer 3 configured physical interfaces that may no participate in VLAN tagged traffic. If you cannot specify both VLANs and physical Layer 3 routed ports at the same time, you can simply run 2 monitoring sessions, or do only physical interfaces which should capture most of the interesting traffic for most cases.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.