Monitoring and Analyzing Switch Operation

Traffic Mirroring

Criteria for Selecting Mirrored Traffic

On the monitored sources listed above, you can configure the following criteria to select the traffic you want to mirror:

■Direction of traffic movement (entering or leaving the switch, or both)

■Type of IPv4 or IPv6 traffic entering the switch, as defined by a classifier- based service policy (see “Selecting Inbound Traffic Using Advanced Classifier-Based Mirroring” on page B-66)

In software release K.14.01 or greater, classifier-based service policies replace ACL-based traffic selection in mirroring sessions.

■Source and/or destination MAC addresses in packet headers

Mirroring Session Limits

A switch running software release K.12.xx or greater supports the following:

■A maximum of four mirroring (local and remote) sessions

■A maximum of 32 remote mirroring endpoints (exit ports connected to a destination device that receive mirrored traffic originating from moni­ tored interfaces on a different switch)

Mirroring Sessions

A mirroring session consists of a mirroring source and destination (endpoint). A mirroring source can be a port or static-trunk list, mesh, or VLAN interface. For any session, the destination must be a single (exit) port. The exit port cannot be a trunk, VLAN, or mesh interface.

Multiple mirroring sessions can be mapped to the same exit port, which provides flexibility in distributing hosts, such as traffic analyzers or an IDS. In a remote mirroring endpoint, the IP address of the exit port and the remote destination switch can belong to different VLANs.

Mirroring sessions can have the same or a different destination. You can configure an exit port on the local (source) switch and/or on a remote switch as the destination in a mirroring session. When configuring a mirroring destination, take into account the following options:

■Mirrored traffic belonging to different sessions can be directed to the same destination or to different destinations.

B-34