Questions tagged [mirror]

For questions about port mirroring on a network device, where a network switch sends a copy of network packets seen on one switch port (or an entire VLAN) to a network monitoring connection on another switch port.

Filter by
Sorted by
Tagged with
1
vote
1answer
31 views

Getting Mulitple Source IP addressess when doing Port Monitoring

I have a Cisco 2960 switch that I'm trying to find which device IP address is connected to each port... My Setup: monitor session 1 source interface gigabitethernet 0/5 monitor session 1 destination ...
1
vote
1answer
43 views

How to do port mirroring in Juniper EX2200 switch

I am using Juniper EX2200 switch, one of the connected System generating lot of unwanted traffic ( varying from 10 Mb to 25 Mb upload traffic). I wanted to analyse those traffic using port mirroring ...
2
votes
2answers
76 views

Obtaining packet switch-port information via a mirrored port?

When sampling a mirrored port of a switch, is there any means of determining the switch-port information of the packet? Since Ethernet packets do not contain this information, I assume the answer is ...
0
votes
0answers
18 views

Mirroring an HP (19xx) stack

I'm looking for a way to mirror an entire HP 19xx switch stack. I have a stack composed of 10 switches and I want to mirror ALL ports (except stack ports) to a single monitor port. Is it possible to ...
0
votes
1answer
77 views

Measurable performance impact of port mirroring on a firewall\security device?

I am setting up a network monitoring device which recommends that I create a mirror interface on my firewall/security appliance and send all packets to the monitor for sniffing, logging, and ...
3
votes
1answer
35 views

Ability to monitor all broadcast domains

Example: Network of company A has 5 VLANs: Accounting, IT, Guests, Servers, Board. All VLANs has DHCP servers enabled in their own VLANs. I am monitoring a single VLAN for DHCP packets by connecting ...
2
votes
1answer
84 views

Cisco Embedded Packet Capture with NAT

I love the ability Cisco's Embedded Packet Capture (EPC) provides to remotely troubleshoot dataflows on IOS routers. monitor capture buffer CAP_BUF monitor capture point ip cef CAP_PT gig 0/0.1 both ...
1
vote
2answers
74 views

Receiving another system's network packets [closed]

I'm looking for a way to receive all network traffic intended to go to my desktop PC, on another device. I believe I need either a network hub or network switch with monitoring port for this, but ...
1
vote
0answers
62 views

Why are multicast frames not showing in the SPAN session? (on Catalyst 2960) [closed]

I have a SPAN monitor session setup to capture both tx/rx on a port 9 (see below). And I can see the multicast count ticking up on port 9. But none of the multicast packets show up in the SPAN session ...
1
vote
1answer
190 views

How can I solve bandwidth problem in process of RSPAN Mirroring?

I will try to explain my problem ; I want to see and analyz the traffic in my LAN Network and I configured RSPAN in the Switches. But all ports of my switches uses.So If I mirroring all the traffics ...
2
votes
2answers
76 views

Capturing traffic from multiple connections on a switch

Consider the traffic monitoring setup on the bottom of this page: https://www.ntop.org/pf_ring/port-mirror-vs-network-tap/ The two lines of a network tap are connected to a switch which merges the ...
0
votes
1answer
193 views

Virtual switch with port mirroring [closed]

I have a lab in which I have three computers connected to a switch. two of the switch's ports are mirrored to a third port so that all the communication between the two computers is mirrored to the ...
1
vote
1answer
92 views

What requirements must general firewall/routing software meet, to make OSI 2 port mirroring work correctly?

The basics are obvious, but there are technical points of networking implication which I don't understand. Some of these are general to networking, others general to all routing/firewall softwares ...
1
vote
1answer
71 views

Sensor to collector communication from SPAN, Inline or TAP

I am trying to figure out which one of the three modes or all would support this. The sensor is a computer running fprobe and pushing UDP traffic (netflow v5) to an IP address in the network. My ...
1
vote
1answer
128 views

How to capture from multiple mirror ports with one NIC

Traffic on the network is in load sharing on 2 switches. Each of the switches will be configured with mirroring of a number of network interfaces to an analysis port (mirror port). I need to capture ...
1
vote
1answer
236 views

How to mirror the WAN port of a Cisco 871 router?

I have setup one IPv6 6to4 tunnel between two routers.The tunnel seems to be up and running and I'm able to ping from Router R1 to R2 as well. However,I would like mirror the WAN port to see the ...
0
votes
1answer
341 views

how to enable normal traffic forwarding on a “destination” interface in a SPAN/mirroring session

Assigning an interface as "destination" for a SPAN/mirrroring session will disrupt normal traffic forwarding on that interface. I want to continue sending and receiving traffic on the destination ...
3
votes
1answer
217 views

Mirror traffic from few interfaces in nexus 3000 switch to 2 interfaces for IPS

I need to be able to mirror traffic from 4 ports on Cisco Nexus 3000 switch to 2 ports on a same switch and connect 2 IPS appliances to those 2 ports. But I don't think it is possible to mirror port ...
2
votes
2answers
2k views

Netflow vs sampled netflow

I'm working on a project where I could need Nexus 5600. These switches support sampled netflow and not netflow. I would like to use netflow to do stats and to analyze trafic at some specific times. ...
1
vote
1answer
40 views

Port SPAN similar to MAC flooding?

I wanted to know if a SPAN port on a switch (which is used to monitor all packets passing through the network) is similar to any other port if a mac flooding attack is performed.
1
vote
1answer
377 views

SPAN mirroring in cisco switch - Invalid input error

I'm trying to enable span mirroring in cisco switch, but the switch doesn't seem to have the "monitor" option. Could someone tell me how to make this work?
2
votes
2answers
627 views

Switch SPAN Port Overload

I would like to monitor all traffic that passes between devices connected to a switch (no particular switch make or model - I would need to do this for many types of switches encountered on many ...
2
votes
1answer
575 views

Is it possible to replicate RSPAN features without trunk ports?

Basically, we have 2 distribution-layer switches on separate sides of our campus, but they're both connected to the same core-layer switch. We don't have any kind of access to the core-layer switch, ...
2
votes
1answer
2k views

Etherchannel physical port SPAN mirror

We have 4x1G Etherchannel on trunk and for troubleshooting i want to monitor one of its physical port. Can i monitor using SPAN port mirror and configure its physical port for source SPAN? Group: ...
1
vote
1answer
414 views

How to access the Cisco Catalyst 2960 Series switch port mirroring webpage/admin interface?

I have read the tutorials about how to send several command lines to setup port mirroring (e.g. source port, destination port). But before sending commands to the switch, I need a administration ...
1
vote
1answer
2k views

Removing source ports from a SPAN session on a cisco nexus switch

So, I have built a tool that allows users to configure SPAN sessions on a Cisco switch. I'm currently trying to get the application to work for the Nexus series but there is one command I'm not sure ...
1
vote
1answer
643 views

Mirroring Ports on a Cisco 3750 Stack

We have a stack of 6, 48 port 3750 cisco switches and I would like to setup mirroring across the stack to send the data to a network analyser. I have done mirroring before on a single switch, but ...
1
vote
1answer
840 views

Juniper mirroring trunk ports

I have a virtual chassis of 2 EX4600-40f. The 4 ports (0/0/1, 0/0/2, 0/0/3, 0/0/4) where my ESX are connected are configured in trunk mode with some vlans. I would like to copy the traffic (tagged) of ...
1
vote
1answer
180 views

VLANs on a span port

I'm currently creating a tool that will allow users to configure SPAN ports on a Cisco switch, and I was going to implement a feature that would allow a user to create a VLAN and add ports to it so it ...
6
votes
2answers
1k views

How to monitor SPAN port for a routed port on 3560G

Is configuring the SPAN port same for a routed port vs a switch port? I have a routed port on my layer-3 3560G for which I need to configure SPAN and capture packets ingress and egress for ...
2
votes
2answers
651 views

Max Number of span sessions

I'm trying to find a command that will show me the max number of span sessions i can have on a single switch, but so far i havent been able to find it. Is there any show command that does this??
2
votes
1answer
131 views

Privilege level on a Cisco switch

I'm just wondering, do you need to have a certain privilege level to set up a SPAN port on a Cisco switch? if so, what minimum level is required to set up a SPAN port? I have no networking experience,...
2
votes
1answer
633 views

Encapsulation of ERSPAN in a linux host (Not cisco switch)

Is there a way to ENCAPSULATE traffic into an ERSPAN tunnel without using a cisco device? What if I wanted to source ERSPAN traffic from a Linux host instead of a switch?
0
votes
1answer
264 views

How to route mirrored traffic?

There is a telco device which can send sip and rtp traffic to only two servers due to its abilities. My goal is to send all the traffic generated by this device to another server located in different ...
1
vote
1answer
3k views

HP A5800 Switch remote port mirror to a virtual host

I have the need to mirror/monitor a port on a HP A5800 AF, but to send the mirrored data for packet capturing to a host which is a virtual server. I'm thinking of having the mirrored traffic dumped ...
1
vote
0answers
53 views

Mirroring private vlan on catalyst switches

I currently have a catalyst switch configured with private VLANs and would like to mirror that traffic to an external system. I have tried creating a monitor session for the VLANs involved but that ...
8
votes
2answers
5k views

Does port mirroring cause additional latency?

If I'm sending traffic from host A to B by a switch, will enabling a mirror/SPAN port increase the time it takes for my frames to get from A to B? Nb: I'm not worried about the time it takes for the ...
3
votes
2answers
399 views

Why vlan is mandatory for rspan network monitoring?

Context :- For network monitoring/packet mirrioring techniques like SPAN and RSPAN. Why is it mandatory to have a dedicated vlan for RSPAN ? why can't we mirror the packets received in a port and ...
1
vote
1answer
116 views

overcome limitation on cisco 6500 monitor session

Is there any way to overcome the 2 monitor session limitation by upgrading the Sup engine card for 6500 Cisco Switch?
6
votes
3answers
2k views

Does a mirror port keep VLAN tags?

I have the following config on a Brocade XMR, running IronWare 5.6.0c. Will the traffic mirrored to e 1/13 keep it's VLAN tags, so I can distinguish where it came from? Or will the tags be stripped ...
6
votes
2answers
842 views

SPAN impact on ASA performance

I am planning to mirror some traffic on an ASA 5510 running version 9.1. this traffic is mostly internet data which cannot exceed 30 Mbps. what impact could this SPAN operation cost me on performance ...
8
votes
1answer
5k views

Remote sniffing with ERSPAN to the desktop

I know how to use both SPAN and RSPAN. If I'm not wrong, ERSPAN leads us to the possibility of remotely monitoring a router through an IP network and a GRE tunnel. However a tunnel end-point is needed....
5
votes
1answer
3k views

Setting up a switch to pass data from a SPAN port

Situation: We have a 3750 with a monitoring session setup on it, grabs a few VLAN's running over the switch and has a destination port on that device (normal SPAN not RSPAN). Historically speaking - ...