Port mirroring refers to the method of copying data from one or more switch ports to one or more monitoring ports. Its purpose is to duplicate packets from specified ports or VLANs to other ports, where the destination port connects to a data monitoring device. To facilitate traffic analysis on one or more network interfaces, you can configure a switch to forward data from one or more ports to a specific port, enabling network monitoring.
I. Based on deployment scope, port mirroring falls into the following three types
1. Local port mirroring: Copies packets from source ports/source VLANs/source CPUs on the device to a destination port on the same device for monitoring and analysis.
2. Layer 2 remote port mirroring: Copies packets from source ports/source VLANs/source CPUs on the local device across a Layer 2 network to a destination port on another device for monitoring and analysis.
3. Layer 3 remote port mirroring: Copies packets from source ports/source VLANs/source CPUs on the local device across a Layer 3 network to a destination port on another device for monitoring and analysis.
II. Port mirroring is implemented through mirroring groups, which are classified into local mirroring groups, remote source mirroring groups, and remote destination mirroring groups
鈼?. Local port mirroring can mirror all packets. It is implemented using a local mirroring group, where source ports/ports within a source VLAN/source CPUs and the destination port reside in the same local mirroring group. The device copies packets from the source port and forwards them to the destination port.
Packets from source ports/source VLANs/source CPUs are mirrored to the destination port, allowing the data monitoring device connected to the destination port to monitor and analyze these packets. Local mirroring groups support cross-board mirroring, meaning the destination port and source ports/ports within a source VLAN/source CPUs can be on different boards within the same device.
鈼?. Layer 2 remote port mirroring can mirror all packets except protocol packets. It is implemented through the cooperation of a remote source mirroring group and a remote destination mirroring group. Users create a remote source mirroring group on the source device and a remote destination mirroring group on the destination device. After copying packets from source ports/source VLANs/source CPUs, the source device broadcasts them within the remote mirroring VLAN through a reflector port and sends them to the destination device via intermediate devices.
Upon receiving the packet, if its VLAN ID matches the VLAN ID of the remote mirroring VLAN in the remote destination mirroring group, the destination device forwards it to the destination port. This way, the data monitoring device connected to the destination port can monitor and analyze packets from source ports/source VLANs/source CPUs on the source device.
III. Users create a remote source mirroring group on the source device and a remote destination mirroring group on the destination device. After copying packets from source ports/source VLANs/source CPUs, the source device broadcasts them within the remote mirroring VLAN through an egress port and sends them to the destination device via intermediate devices. The data monitoring device connected to the destination port can then monitor and analyze packets from source ports/source VLANs/source CPUs on the source device.
鈼?. Users must ensure Layer 2 connectivity between the source and destination devices within the remote mirroring VLAN.
鈼?. Because packets from source ports/source VLANs/source CPUs will be broadcast within the remote mirroring VLAN on the source device, you can achieve local port mirroring functionality by adding other ports on the source device to the remote mirroring VLAN. During the process of