Port Mirroring to Multiple Ports - Duplicate Traffic?

  • 0
  • 2
  • Question
  • Updated 4 months ago
  • Answered
Having 2 "to ports" configured in a mirror, are they identical duplicated traffic from the mirror ports in the port-list or are the 2 ports load balanced?  I have 2 ports configured to send to an Alienvault for logging, so is the AV server receiving duplicate traffic?

create mirror "AlienVault"
configure mirror AlienVault to port-list 1:44,2:44 loopback-port 1:49 
enable mirror AlienVault 
configure mirror AlienVault add port 1:1,2:1 ingress-and-egress
configure mirror AlienVault add port 1:2,1:11-19,1:23,1:41,2:2 ingress-and-egress
configure mirror AlienVault add port 1:3,2:3 ingress-and-egress
configure mirror AlienVault add port 1:47-48 ingress-and-egress
Photo of Aires Sysadmins

Aires Sysadmins

  • 100 Points 100 badge 2x thumb

Posted 4 months ago

  • 0
  • 2
Photo of Karthik Mohandoss

Karthik Mohandoss, Employee

  • 5,438 Points 5k badge 2x thumb
Hi Aires,

The port 1:44 and 2:44 will have the same traffic (duplicated) and not load balanced.
Photo of Alexandr P

Alexandr P, Embassador

  • 11,666 Points 10k badge 2x thumb
Hi, Aires!

Details you can find  here - https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-mirror-to-multiple-ports

"
  • The port-list is a list of monitor ports that transmit identical copies of mirrored packets.


Thank you!
Photo of Aires Sysadmins

Aires Sysadmins

  • 100 Points 100 badge 2x thumb
Ok, that's what we were thinking as well. Thanks for the replies!