Packet Broker Functions

A network packet broker aggregates network traffic from multiple ports for forwarding to analysis applications.

When a packet broker is attached to networking devices, a copy of the traffic that passes through the devices is sent to the packet broker. Based on your configuration, the packet broker filters the copied traffic for the data that you want to analyze. The broker then sends the filtered traffic to an analysis application.

In general, packet brokers can perform the following types of actions on copied network traffic.

Table 1. Packet broker functions
Function	Description
ACL filtering	Directs network traffic based on Layer 2 to Layer 4 protocol headers
Aggregation	Combines traffic that from multiple ports and directs it to one port or port channel
Decapsulation	Removes the outer tunnel headers from a packet
Header stripping	Removes header tags that are not supported by some visibility applications, including 802.1BR, VN (virtual NIC), VLAN, VXLAN, GTPU, GRE, and IPIP headers
Load balancing	Distributes network traffic among ports in a port channel
Packet slicing	Filters packet headers for the header components that you want to target. For a list of such components, see Create a Policy Rule Match for a Device.
Replication	Copies network traffic to multiple ports and port channels
Route map forwarding	Redirects Layer 2 and Layer 3 packets to the selected physical or port channel interface
Transport tunnel termination	GRE (Generic Routing Encapsulation). Creates a tunnel that encapsulates (or wraps) packets that use one type of protocol inside packets that use a different protocol. ERSPAN (Encapsulated Remote Switched Port Analyzer): Creates a tunnel that mirrors traffic from source ports for delivery to destination ports on a different device.
Transport tunnel encapsulation	GRE only