Questions tagged [mirror]
For questions about port mirroring on a network device, where a network switch sends a copy of network packets seen on one switch port (or an entire VLAN) to a network monitoring connection on another switch port.
53
questions
0
votes
0
answers
21
views
port-mirror-instance
I'm trying to mirror all traffic using the configuration below, but it doesn't seem to be working. Please help.
https://supportportal.juniper.net/s/article/MX-How-to-configure-Layer-2-VPLS-Port-...
0
votes
1
answer
85
views
SPAN/RSPAN monitoring VLAN vs Interface
I am a little lost with regards to the concept of capturing every traffic passing a core switch. If we set our monitor source to be all VLANs in a L3 switch, does that mean that traffic coming from a ...
- 3
2
votes
1
answer
47
views
ERSPAN between two routers
My goal is to have two ERSPAN sessions between two routers, R1 and R2.
Currently, one ERSPAN session is already configured from R1 to R2, copying traffic of vlan 35 to a physical port on R2.
I need to ...
- 590
1
vote
0
answers
62
views
Port mirroring traffic on Hyper-V not showing Layer 3-7 traffic [closed]
We've been experiencing some issues with port mirroring that is used by a Network Intrusion detection system. Our company uses AlienVault as a SIEM and uses a Hyper-V sensor which is used to forward ...
- 11
0
votes
0
answers
172
views
Dropping packets when mirroring a switch trunk port
I'm building a test lab to support a networking monitoring application I'm developing.
I have written a simple UDP packet generator and receiver, and I use iperf3 to create some bulk background ...
0
votes
2
answers
279
views
How to Balance SPAN Traffic from Redundant Switches
So we are wanting to deploy an IDS device to capture EAST-WEST traffic in a LAN.
The actual topology is more complicated but our issue boils down to this:
We are attempting to configure SPAN sessions ...
0
votes
1
answer
550
views
Capture traffic flowing through a Brocade switch remotely
I am currently doing packet capture through mirroring with Wireshark as mentioned in this post
I can mirror the traffic to a port physically jacked into and analyze the packets redirected there w/ ...
1
vote
1
answer
50
views
Can use virtual port as the port mirroring's destination port?
Port mirroring can mirror several source port to a destination port(mirroring port).
I have several questions about port mirroring.
in the dest port, how to differentiate the different source port? ...
- 1,747
0
votes
2
answers
46
views
why it isnt possible to convert span into rspan by cabling two ports?
On a on a switch that only support span, and dont support rspan, as long as span only allow destination port to be on the same switch as the source, why cant we connect two switch ports together with ...
- 1
1
vote
1
answer
143
views
Port mirroring question
I've got some questions about my port mirroring configuration. I'm working with alcatel omniswitch.
After configuring port mirroring my destination port is loosing network connection and it can't ...
- 13
1
vote
1
answer
1k
views
mirroring-group not possible on Aruba switch
I am currently in the situation of needing to monitor several ports on a Aruba 2530-24G simultaneously from several other ports. Those are basically HP devices, right?
A good solution would be a ...
- 115
1
vote
1
answer
42
views
Getting Mulitple Source IP addressess when doing Port Monitoring
I have a Cisco 2960 switch that I'm trying to find which device IP address is connected to each port...
My Setup:
monitor session 1 source interface gigabitethernet 0/5
monitor session 1 destination ...
- 11
1
vote
1
answer
878
views
How to do port mirroring in Juniper EX2200 switch
I am using Juniper EX2200 switch, one of the connected System generating lot of unwanted traffic ( varying from 10 Mb to 25 Mb upload traffic). I wanted to analyse those traffic using port mirroring ...
2
votes
2
answers
86
views
Obtaining packet switch-port information via a mirrored port?
When sampling a mirrored port of a switch, is there any means of determining the switch-port information of the packet?
Since Ethernet packets do not contain this information, I assume the answer is ...
- 169
0
votes
1
answer
315
views
Measurable performance impact of port mirroring on a firewall\security device?
I am setting up a network monitoring device which recommends that I create a mirror interface on my firewall/security appliance and send all packets to the monitor for sniffing, logging, and ...
- 101
3
votes
1
answer
83
views
Ability to monitor all broadcast domains
Example:
Network of company A has 5 VLANs: Accounting, IT, Guests, Servers, Board.
All VLANs has DHCP servers enabled in their own VLANs. I am monitoring a single VLAN for DHCP packets by connecting ...
- 33
2
votes
1
answer
303
views
Cisco Embedded Packet Capture with NAT
I love the ability Cisco's Embedded Packet Capture (EPC) provides to remotely troubleshoot dataflows on IOS routers.
monitor capture buffer CAP_BUF
monitor capture point ip cef CAP_PT gig 0/0.1 both
...
- 666
1
vote
2
answers
76
views
Receiving another system's network packets [closed]
I'm looking for a way to receive all network traffic intended to go to my desktop PC, on another device.
I believe I need either a network hub or network switch with monitoring port for this, but ...
- 13
1
vote
0
answers
145
views
Why are multicast frames not showing in the SPAN session? (on Catalyst 2960) [closed]
I have a SPAN monitor session setup to capture both tx/rx on a port 9 (see below). And I can see the multicast count ticking up on port 9. But none of the multicast packets show up in the SPAN session ...
- 111
1
vote
1
answer
426
views
How can I solve bandwidth problem in process of RSPAN Mirroring?
I will try to explain my problem ;
I want to see and analyz the traffic in my LAN Network and I configured RSPAN in the Switches.
But all ports of my switches uses.So If I mirroring all the traffics ...
- 11
2
votes
2
answers
213
views
Capturing traffic from multiple connections on a switch
Consider the traffic monitoring setup on the bottom of this page: https://www.ntop.org/pf_ring/port-mirror-vs-network-tap/
The two lines of a network tap are connected to a switch which merges the ...
- 21
0
votes
1
answer
281
views
Virtual switch with port mirroring [closed]
I have a lab in which I have three computers connected to a switch.
two of the switch's ports are mirrored to a third port so that all the communication between the two computers is mirrored to the ...
- 103
1
vote
1
answer
108
views
What requirements must general firewall/routing software meet, to make OSI 2 port mirroring work correctly?
The basics are obvious, but there are technical points of networking implication which I don't understand.
Some of these are general to networking, others general to all routing/firewall softwares ...
- 111
1
vote
1
answer
161
views
Sensor to collector communication from SPAN, Inline or TAP
I am trying to figure out which one of the three modes or all would support this. The sensor is a computer running fprobe and pushing UDP traffic (netflow v5) to an IP address in the network.
My ...
- 135
1
vote
1
answer
339
views
How to capture from multiple mirror ports with one NIC
Traffic on the network is in load sharing on 2 switches. Each of the switches will be configured with mirroring of a number of network interfaces to an analysis port (mirror port). I need to capture ...
- 13
1
vote
1
answer
391
views
How to mirror the WAN port of a Cisco 871 router?
I have setup one IPv6 6to4 tunnel between two routers.The tunnel seems to be up and running and I'm able to ping from Router R1 to R2 as well.
However,I would like mirror the WAN port to see the ...
- 1,412
0
votes
1
answer
877
views
how to enable normal traffic forwarding on a "destination" interface in a SPAN/mirroring session
Assigning an interface as "destination" for a SPAN/mirrroring session will disrupt normal traffic forwarding on that interface.
I want to continue sending and receiving traffic on the destination ...
- 11
3
votes
1
answer
522
views
Mirror traffic from few interfaces in nexus 3000 switch to 2 interfaces for IPS
I need to be able to mirror traffic from 4 ports on Cisco Nexus 3000 switch to 2 ports on a same switch and connect 2 IPS appliances to those 2 ports. But I don't think it is possible to mirror port ...
- 175
2
votes
2
answers
4k
views
Netflow vs sampled netflow
I'm working on a project where I could need Nexus 5600. These switches support sampled netflow and not netflow. I would like to use netflow to do stats and to analyze trafic at some specific times.
...
- 180
1
vote
1
answer
69
views
Port SPAN similar to MAC flooding?
I wanted to know if a SPAN port on a switch (which is used to monitor all packets passing through the network) is similar to any other port if a mac flooding attack is performed.
- 13
1
vote
1
answer
650
views
SPAN mirroring in cisco switch - Invalid input error
I'm trying to enable span mirroring in cisco switch, but the switch doesn't seem to have the "monitor" option. Could someone tell me how to make this work?
- 11
2
votes
2
answers
1k
views
Switch SPAN Port Overload
I would like to monitor all traffic that passes between devices connected to a switch (no particular switch make or model - I would need to do this for many types of switches encountered on many ...
- 21
2
votes
1
answer
878
views
Is it possible to replicate RSPAN features without trunk ports?
Basically, we have 2 distribution-layer switches on separate sides of our campus, but they're both connected to the same core-layer switch. We don't have any kind of access to the core-layer switch, ...
- 21
2
votes
1
answer
3k
views
Etherchannel physical port SPAN mirror
We have 4x1G Etherchannel on trunk and for troubleshooting i want to monitor one of its physical port.
Can i monitor using SPAN port mirror and configure its physical port for source SPAN?
Group: ...
- 4,361
1
vote
1
answer
664
views
How to access the Cisco Catalyst 2960 Series switch port mirroring webpage/admin interface?
I have read the tutorials about how to send several command lines to setup port mirroring (e.g. source port, destination port). But before sending commands to the switch, I need a administration ...
- 271
1
vote
1
answer
3k
views
Removing source ports from a SPAN session on a cisco nexus switch
So, I have built a tool that allows users to configure SPAN sessions on a Cisco switch. I'm currently trying to get the application to work for the Nexus series but there is one command I'm not sure ...
- 201
1
vote
1
answer
1k
views
Mirroring Ports on a Cisco 3750 Stack
We have a stack of 6, 48 port 3750 cisco switches and I would like to setup mirroring across the stack to send the data to a network analyser. I have done mirroring before on a single switch, but ...
- 243
1
vote
1
answer
2k
views
Juniper mirroring trunk ports
I have a virtual chassis of 2 EX4600-40f. The 4 ports (0/0/1, 0/0/2, 0/0/3, 0/0/4) where my ESX are connected are configured in trunk mode with some vlans.
I would like to copy the traffic (tagged) of ...
- 43
1
vote
1
answer
307
views
VLANs on a span port
I'm currently creating a tool that will allow users to configure SPAN ports on a Cisco switch, and I was going to implement a feature that would allow a user to create a VLAN and add ports to it so it ...
- 201
6
votes
2
answers
2k
views
How to monitor SPAN port for a routed port on 3560G
Is configuring the SPAN port same for a routed port vs a switch port?
I have a routed port on my layer-3 3560G for which I need to configure SPAN and capture packets ingress and egress for ...
- 317
2
votes
2
answers
815
views
Max Number of span sessions
I'm trying to find a command that will show me the max number of span sessions i can have on a single switch, but so far i havent been able to find it.
Is there any show command that does this??
- 201
2
votes
1
answer
255
views
Privilege level on a Cisco switch
I'm just wondering, do you need to have a certain privilege level to set up a SPAN port on a Cisco switch? if so, what minimum level is required to set up a SPAN port?
I have no networking experience,...
- 201
2
votes
1
answer
806
views
Encapsulation of ERSPAN in a linux host (Not cisco switch)
Is there a way to ENCAPSULATE traffic into an ERSPAN tunnel without using a cisco device? What if I wanted to source ERSPAN traffic from a Linux host instead of a switch?
- 21
0
votes
1
answer
345
views
How to route mirrored traffic?
There is a telco device which can send sip and rtp traffic to only two servers due to its abilities. My goal is to send all the traffic generated by this device to another server located in different ...
- 1
1
vote
1
answer
3k
views
HP A5800 Switch remote port mirror to a virtual host
I have the need to mirror/monitor a port on a HP A5800 AF, but to send the mirrored data for packet capturing to a host which is a virtual server.
I'm thinking of having the mirrored traffic dumped ...
- 13
1
vote
0
answers
60
views
Mirroring private vlan on catalyst switches
I currently have a catalyst switch configured with private VLANs and would like to mirror that traffic to an external system. I have tried creating a monitor session for the VLANs involved but that ...
- 173
9
votes
2
answers
10k
views
Does port mirroring cause additional latency?
If I'm sending traffic from host A to B by a switch, will enabling a mirror/SPAN port increase the time it takes for my frames to get from A to B?
Nb: I'm not worried about the time it takes for the ...
- 369
3
votes
2
answers
517
views
Why vlan is mandatory for rspan network monitoring?
Context :- For network monitoring/packet mirrioring techniques like SPAN and RSPAN.
Why is it mandatory to have a dedicated vlan for RSPAN ? why can't we mirror the packets received in a port and ...
- 1,124
1
vote
1
answer
128
views
overcome limitation on cisco 6500 monitor session
Is there any way to overcome the 2 monitor session limitation by upgrading the Sup engine card for 6500 Cisco Switch?
- 11
7
votes
3
answers
2k
views
Does a mirror port keep VLAN tags?
I have the following config on a Brocade XMR, running IronWare 5.6.0c.
Will the traffic mirrored to e 1/13 keep it's VLAN tags, so I can distinguish where it came from? Or will the tags be stripped ...
- 622