enable mirror to port
enable mirror to [port
port | port-list
port_list
loopback-port
port] {remote-tag
tag}
Description
Dedicates a port on the switch to be the mirror output port, or the monitor port.
Syntax Description
port
|
Specifies the mirror output
port. |
port_list
|
Specifies the list of ports
where traffic is to be mirrored. |
loopback-port
|
Specifies an otherwise unused
port required when mirroring to a port_list. The
loopback-port is not available for switching user data
traffic. |
port
|
Specifies a single loopback
port that is used internally to provide this feature. |
remote-tag
|
Specifies the value of the
This command is available on
the ExtremeSwitching X440-G2, X450-G2, X460-G2, X465, X590, X620, and X695 series
switches. ID used by the mirrored
packets when egressing the monitor port. |
Usage Guidelines
Port mirroring configures the switch to copy all traffic
associated with one or more ports, VLANS or virtual ports. A virtual port is a
combination of a VLAN and a port. The monitor port(s) can be connected to a network
analyzer or RMON probe for packet analysis. The switch uses a traffic filter that
copies a group of traffic to the monitor port.
Up to 16 mirroring filters and up to four monitor ports can be
configured on the switch. After a port has been specified as a monitor port, it
cannot be used for any other function. Frames that contain errors are not
mirrored.
You cannot run ELSM and mirroring on the same port. If you
attempt to enable mirroring on a port that is already enabled for ELSM, the switch
returns a message similar to the following:
Error: Port mirroring cannot be enabled on an ELSM enabled port.
Standalone Switches and
SummitStacks
The traffic filter can be defined based on one of the following
criteria:
- Physical port—All data
that traverses the port, regardless of VLAN configuration, is copied to the
monitor port(s). You can specify which traffic the port mirrors:
- Ingress—Mirrors traffic received at the port.
- Egress—Mirrors traffic sent from the port.
-
Ingress and egress—Mirrors traffic either received
at the port or sent from the port.
(If you omit the optional parameters, all traffic
is forwarded; the default for port-based mirroring is ingress and
egress).
- VLAN—All data to a particular VLAN, regardless of the
physical port configuration, is copied to the monitor port.
- Virtual port—All data
specific to a VLAN on a specific port is copied to the monitor port.
- ExtremeSwitching series
switches support a maximum of 128 mirroring filters with the restriction that a
maximum of 16 VLAN and/or virtual port (port + VLAN) filters may be
configured.
- ExtremeXOS supports up to 16 monitor ports for one-to-many
mirroring.
- Only traffic ingressing a VLAN can be monitored; you cannot
specify ingressing or egressing traffic when mirroring VLAN traffic.
- Ingress traffic is mirrored as it is received (on the
wire).
- Packets which match both an ingress filter and an egress
filter will result in two packets egressing the monitor port or ports.
- In normal mirroring, a monitor port cannot be added to a
load share group. In one-to-many mirroring, a monitor port list can be added to
a load share group, but a loopback port cannot be used in a load share group.
- You can run mirroring and sFlow
on the same device when you are running ExtremeSwitching series
switches.
- With a monitor port or ports on
ExtremeSwitching series switches, all traffic ingressing the monitor
port or ports is tagged only if the ingress packet is tagged. If the packet
arrived at the ingress port as untagged, the packet egress the monitor port or
ports as untagged.
- Two packets are mirrored when a packet encounters both an
ingress and egress mirroring filter.
-
The configuration of remote-tag does not require the
creation of a VLAN with the same tag; on these platforms the existence of a
VLAN with the same tag as a configured remote-tag is prevented. This
combination is allowed so that an intermediate remote mirroring switch can
configure remote mirroring using the same remote mirroring tag as other
source switches in the network. Make sure that VLANs meant to carry normal
user traffic are not configured with a tag used for remote mirroring.
When a VLAN is created with remote-tag, that tag is locked
and a normal VLAN cannot have that tag. The tag is unique across the switch.
Similarly if you try to create a remote-tag VLAN where remote-tag already
exists in a normal VLAN as a VLAN tag, you cannot use that tag and the VLAN
creation fails.
SummitStack Only
The traffic filter can be defined based on one of the
following criteria:
- Physical port—All data
that traverses the port, regardless of VLAN configuration, is copied to the
monitor port(s). You can specify which traffic the port mirrors:
- Ingress—Mirrors traffic received at the port.
- Egress—Mirrors traffic sent from the port.
-
Ingress and egress—Mirrors traffic either received
at the port or sent from the port.
(If you omit the optional parameters, all traffic
is forwarded; the default for port-based mirroring is ingress and
egress).
- VLAN—All data to a
particular VLAN, regardless of the physical port configuration, is copied to the
monitor port.
- Virtual port—All data
specific to a VLAN on a specific port is copied to the monitor port.
- SummitStack supports a maximum of 128 mirroring filters with
the restriction that a maximum of 16 VLAN and/or virtual port (port + VLAN)
filters may be configured.
- ExtremeXOS supports up to 16 monitor ports for one-to-many
mirroring.
- Only traffic ingressing a VLAN can be monitored; you cannot
specify ingressing or egressing traffic when mirroring VLAN traffic.
- Ingress traffic is mirrored as it is received (on the
wire).
- Two packets are mirrored when a packet encounters both an
ingress and egress mirroring filter.
- When traffic is modified by hardware on egress, egress
mirrored packets may not be transmitted out of the monitor port as they egressed
the port containing the egress mirroring filter. For example, an egress mirrored
packet that undergoes VLAN translation is mirrored with the untranslated VLAN
ID. In addition, IP multicast packets which are egress mirrored contain the
source MAC address and VLAN ID of the unmodified packet.
- You cannot include the monitor port for a SummitStack in a
load-sharing group.
- You can run mirroring and sFlow on the same device when you
are running a SummitStack.
- With a monitor port or ports, the mirrored packet is tagged
only if the ingress packet is tagged (regardless of what module the ingressing
port is on). If the packet arrived at the ingress port as untagged, the packet
egress the monitor port(s) as untagged.
- You may see a packet mirrored twice. This occurs only if
both the ingress mirrored port and the monitor port or ports are on the same
one-half of the module and the egress mirrored port is either on the other
one-half of that module or on another module.
- When traffic is modified by hardware on egress, egress
mirrored packets may not be transmitted out of the monitor port as they egressed
the port containing the egress mirroring filter. For example, an egress mirrored
packet that undergoes VLAN translation is mirrored with the untranslated VLAN
ID. In addition, IP multicast packets which are egress mirrored contain the
source MAC address and VLAN ID of the unmodified packet.
- The configuration of remote-tag does not require the
creation of a VLAN with the same tag; on these platforms the existence of a VLAN
with the same tag as a configured remote-tag is prevented. This combination is
allowed so that an intermediate remote mirroring switch can configure remote
mirroring using the same remote mirroring tag as other source switches in the
network. Make sure that VLANs meant to carry normal user traffic are not
configured with a tag used for remote mirroring.
- When a VLAN is created with remote-tag, that tag is locked
and a normal VLAN cannot have that tag. The tag is unique across the switch.
Similarly if you try to create a remote-tag VLAN where remote-tag already exists
in a normal VLAN as a VLAN tag, you cannot use that tag and the VLAN creation
fails.
Example
The following example selects port 4 as the mirror, or monitor,
port:
# enable mirror to port 4
History
This command was added in ExtremeXOS 15.3.
Platform Availability
This command is available on ExtremeSwitching X435,
X440-G2, X450-G2, X460-G2, X465, X590, X620, and X695 series switches.