Troubleshooting Guide

Port mirroring
Virtual Services Platform 4000 has a port mirroring feature that helps you monitor and analyze
network traffic. Port mirroring supports both ingress (incoming traffic) and egress (outgoing traffic)
port mirroring. When you enable port mirroring, the system forwards ingress or egress packets
normally from the mirrored (source) port, and sends a copy of the packet to the mirroring
(destination) port.
Overview
Port mirroring causes the switch to make a copy of a traffic flow and send the copy to a device for
analysis. Use port mirroring in diagnostic sniffing—use the mirror to view the packets in the flow
without breaking the physical connection to place a packet sniffer inline. You can also use mirroring
for security reasons.
You can use egress mirroring to monitor packets as they leave specified ports.
Use a network analyzer to observe and analyze packet traffic at the mirroring port. Unlike other
methods that analyze packet traffic, the packet traffic is uninterrupted and packets flow normally
through the mirrored port.
You can mirror to a port or list of ports or a MultiLink Trunking (MLT) group. Virtual Services
Platform 4000 supports one-to-many, many-to-one, and many-to-many mirroring configurations.
Port mirroring and modules
You can use all module ports in the system to function as an ingress port for mirroring (mirrored
port), an egress port for mirroring (mirrored port), or as a mirroring port (where all the mirrored traffic
is redirected. The number of mirroring ports (also called destination ports) that you can configure is
limited by the hardware. The hardware limitation is 4 ports simultaneously (where each mirroring
direction counts as one). For example, if two mirroring ports are designated to mirror both ingress
and egress traffic then all 4 mirroring ports are consumed.
The following table describes ingress mirroring functionality for modules. Only one type of mirroring
destination is supported at a time. You cannot mirror the same port to multiple classes of
destinations, for example, MLT. However, you can mirror to multiple physical destinations.
Table 2: Ingress mirroring functionality
Function
Support information
Ingress port mirroring and ingress flow mirroring Supported. Maximum of 4 mirror-to-ports per box.
One port to one port Supported
One to MLT group [for threat protection system (TPS
applications)]
Supported
One to many (multicast group ID/VLAN) Not supported
One to one (remote mirrored destination) Not supported
Many to one (multiple mirrored ports to one mirroring
port)
Supported
Many to MLT group Supported
Table continues…
Port mirroring
January 2017 Troubleshooting 31
Comments on this document? [e-mail]