Mirroring and Monitoring
Introduction
Mirroring allows packets from a specified source to be copied to a destination port without affecting packet processing on a network device such as a switch or router. The destination port is directly or indirectly connected to a monitoring device on which analysis software is installed to analyze packets.
When an attack or a fault occurs on the network, the network administrator can use the mirroring function to obtain and analyze packets to find out the attack source or fault cause.
Mirroring is classified into three mirroring configurations, based on the mirroring source.
- ESU Port mirroring copies from the mirrored port to the observer port without any filtering criteria. The command allows you to specify whether you want ingress, egress or both.
- ESU Flow mirroring copies the incoming and outgoing packets from the mirrored port to the observer port, selectively based on matching criteria specified using ACL rules or configuration commands.
- OLT-2/OIU2/BOLT - portmirroring and flowmirroring are combined into one single flowmirroring command and copies the incoming and outgoing packets from the mirrored port to the observer port, selectively based on matching criteria specified using ACL rules or configuration commands.
With flow mirroring, administrators can selectively copy packets that meet specific criteria, enabling more precise network traffic monitoring and analysis. This is particularly useful for network security analysis, troubleshooting, and performance optimization.
Document Number
ENG-010693
Applies to
CLI Mirroring support is provided for all OLTs running software releases SR32 or above.
How Does Port Mirroring Work?
Local port mirroring is the most basic form of mirroring. The source ports are located on the same network switch as the monitoring port. As shown in the figure below, local port mirroring enables the switch to forward the packet copy on the source port (net1-12) to the observing port (MDS1-ESU<A or B>-[1-6]). Then the packet monitoring device connected with the observing port can monitor and analyze the packet.
The following CLI procedures will enable packet mirroring.
Contents