Configuring Port Mirroring

About this task

Use port mirroring to make a copy of a traffic flow and send that copy to a device for analysis, for example, for diagnostic sniffing. Use the mirror to see the packets in the flow without breaking into the physical connection to place a packet onto the sniffer inline. You can also use port mirroring for security. You can send flows to inspection engines for post processing.

Connect the sniffer (or other traffic analyzer) to the output port you specify in this procedure.

1. Enter Global Configuration mode:

   enable

   configure terminal

2. Create a port mirroring instance:

   mirror-by-port <1-479> in-port {slot/port[/sub-port] [-slot/port[/sub-port]] [,...]} {monitor-mlt <1-512>| out-port {slot/port[/sub-port] [-slot/port[/sub-port]] [,...]}

3. Create an I-SID mirroring instance:

   mirror-by-port <1–479> [in-port {slot/port[/sub-port] [-slot/port[/sub-port]] [,...]} monitor-isid-offset <1-1000> [mode <rx|tx|both>][qos <qos-level>]]

4. Configure the mode:

   mirror-by-port <1-479> mode <both|rx|tx>

   

   Note

   • When you configure tx mode port mirroring on T-UNI and SPBM NNI ports, unknown unicast, broadcast and multicast traffic packets that ingress these ports and the system displays it on the mirror destination port, although they do not egress the mirror source port. This is because tx mode port mirroring happens on the mirror source port before the source port squelching logic drops the packets at the egress port.

   • The available four mirroring resources are shared between Fabric RSPAN and regular port mirroring, and are allocated based on the mode configured, Ingress (rx) or Egress (tx). Each configured mode occupies one mirroring resource, but when you configure the mode as both, it occupies two mirroring resources (one for Rx and one for Tx).

   • Do not configure the source of mirrored traffic (mirroring to an I-SID) and the analyzer (monitoring an I-SID) on the same local device with the same I-SID offset. If you require mirroring and monitoring on the same local device, use standard port-based mirroring instead of Fabric RSPAN. Fabric RSPAN mirrors traffic into an I-SID of the SPB Fabric network and monitors traffic on the remote device; the network analyzer resides on the remote monitoring device and not on the same local device.

5. Enable the mirroring instance:

   mirror-by-port <1-479> enable

6. Modify existing mirroring entries as required:

   mirror-by-port mirror-port <1-479> {slot/port[/sub-port] [-slot/port[/sub-port]] [,...]}

   OR

   mirror-by-port monitor-mlt <1-479> <1-512>

   OR

   mirror-by-port monitor-port <1-479> {slot/port[/sub-port] [-slot/port[/sub-port]] [,...]}

   

   Note

   Before you can modify an existing entry, you must disable the entry: no mirror-by-port <1-479> enable .

7. Modify QoS value for Fabric RSPAN mirroring session:

   mirror-by-port <1-479> qos <0-5>

8. Verify the configuration:

   show mirror-by-port

Example

Port mirroring configuration:

Switch:1> enable

Switch:1# configure terminal

Create the port mirroring instance:

Switch:1(config)# mirror-by-port 8 in-port 1/15 out-port 1/1

The analyzer connects to port 1/1.

Disable the entry:

Switch:1(config)# no mirror-by-port 8 enable

Mirror both ingress and egress traffic passing through port 1/16:

Switch:1(config)# mirror-by-port 8 mode both

Enable mirroring for the instance:

Switch:1(config)# mirror-by-port 8 enable

Fabric RSPAN configuration:

Switch:1> enable

Switch:1# configure terminal

Create the Fabric RSPAN mirroring instance:

Switch:1(config)#mirror-by-port 3 in-port 1/3 monitor-isid-offset 3 mode both qos 3

Disable the entry:

Switch:1(config)# no mirror-by-port 3 enable

Mirror the egress traffic passing through port 1/3:

Switch:1(config)# mirror-by-port 3 mode tx

Enable Fabric RSPAN for the instance:

Switch:1(config)# mirror-by-port 3 enable

The sample command output in the following example does not necessarily reflect the preceding examples.

Switch:1>enable
Switch:1#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.
Switch:1(config)#show mirror-by-port

=============================================================================
                              Diag Mirror-By-Port

=============================================================================
ID   MIRRORED_PORT   MIRRORING_DEST  ENABLE   MODE  REMOTE-MIRROR   DSCP TTL
                                                      VLAN-ID
------------------------------------------------------------------------------
1     1/1              2/1           true      both    0   0             64
2     1/2              2/2           true      rx      0   0             64 
3     1/3              2/3           true      tx      0   0             64
4     1/4              2/4           true      both    0   0             64