Understanding Port Mirroring

Port mirroring, also known as SPAN (Switched Port Analyzer), is a network monitoring technique that allows network administrators to copy traffic from one or more source ports to a destination port for analysis. This feature is essential for network troubleshooting, security monitoring, and performance analysis.

The technology works by duplicating network packets from designated source ports and forwarding them to a monitoring port where analysis tools like Wireshark or network analyzers can capture and examine the traffic. Administrators can choose to mirror inbound traffic, outbound traffic, or both directions depending on their monitoring requirements.

Configuration Examples Across Vendors

Huawei Switch Configuration

// One-to-one local port mirroring
observe-port 1 interface GigabitEthernet1/0/2
interface GigabitEthernet1/0/1
port-mirroring to observe-port 1 both

// Multi-to-one port mirroring
observe-port 1 interface-range GigabitEthernet1/0/2 to GigabitEthernet1/0/4
interface GigabitEthernet1/0/1
port-mirroring to observe-port 1 inbound

// One-to-many port mirroring
observe-port 1 interface GigabitEthernet1/0/5
interface GigabitEthernet1/0/2
port-mirroring to observe-port 1 outbound
interface GigabitEthernet1/0/3
port-mirroring to observe-port 1 outbound

Cisco Switch Configuration

// Create monitoring session
monitor session 1 source interface GigabitEthernet1/0/1-5 both
monitor session 1 destination interface GigabitEthernet1/0/6

// Alternative single port configuration
monitor session 2 source interface FastEthernet0/1 rx
monitor session 2 destination interface FastEthernet0/2

// Verify configuration
show monitor session 1

// Remove session if needed
no monitor session 1

H3C Switch Configuration

// Create local mirroring group
mirroring-group 1 local

// Configure source ports
mirroring-group 1 mirroring-port GigabitEthernet1/0/1 inbound
mirroring-group 1 mirroring-port GigabitEthernet1/0/2 outbound

// Configure destination port
mirroring-group 1 monitor-port GigabitEthernet1/0/3

// Disable STP on monitor port
interface GigabitEthernet1/0/3
undo stp enable

// Verify configuration
display mirroring-group 1

Ruijei Switch Configuration

// Configure Remote VLAN for RSPAN
vlan 500
remote-span

// Create RSPAN session
monitor session 2 remote-source
monitor session 2 source interface GigabitEthernet4/1 both

// Configure destination port
monitor session 2 destination remote vlan 500 interface GigabitEthernet4/2

// Configure monitor port
interface GigabitEthernet4/2
switchport access vlan 500
mac-loopback
no mac-address-learning

// Clear MAC table
clear mac-address-table dynamic interface GigabitEthernet4/2

// Prune VLAN from trunk ports
interface range GigabitEthernet4/5-10
switchport trunk allowed vlan remove 500

Common Use Cases

• Network Troubleshooting: Identifying performance bottlenecks and connectivity issues
• Security Monitoring: Dteecting malicious traffic and potential security breaches
• Application Analysis: Monitoring specific application traffic patterns
• Compliance Auditing: Capturing traffic for regulatory compliance requirements

When implementing port mirroring, consider the performance impact on the switch, especially when mirroring high-traffic ports. The monitoring port should be connected to a dedicated analysis device to prevent network congestion.