topic Re: RE: Port Mirror limitations in ExtremeSwitching (Other)

Port Mirror limitations

Uber_Londono — Thu, 23 Apr 2015 22:12:00 GMT

Hello, I need to know how many port mirroring can create in a Summit x440, I mean, I have a 48 ports, can create 46 Mirror and sen the traffic to one especific port?

RE: Port Mirror limitations

BrandonC — Thu, 23 Apr 2015 22:24:00 GMT

Hi Uber,

You should be able to mirror ports 1-46 to port 48. After EXOS 15.3, up to four mirror instances are allowed, but this config would only use one mirror instance.

One thing to be aware of, however, is that since you are mirroring 46 ports, there is a potential for up to 92 gbps of traffic to be included in the mirror (1G ingress and egress on each mirrored port). Because of this, some traffic may not be seen on the monitor port due to bandwidth limitations.

RE: Port Mirror limitations

Uber_Londono — Thu, 23 Apr 2015 22:28:00 GMT

Thanks Brandon.

RE: Port Mirror limitations

Sean_Brady — Thu, 23 Apr 2015 23:53:00 GMT

Uber, you can also mirror an entire VLAN to a monitor port. Depending on the amount of traffic on the VLAN this could potentially saturate the monitor port.

RE: Port Mirror limitations

Uber_Londono — Fri, 24 Apr 2015 03:48:00 GMT

Thanks Sean, only one question, in the documentation I see "For VLANs and virtual ports, only traffic ingressing these interfaces are mirroring", I need the Mirror for recording issues and I need record both ingress and egress, is that posible??
Regards

RE: Port Mirror limitations

BrandonC — Fri, 24 Apr 2015 03:48:00 GMT

Uber,

When mirroring a VLAN, you are limited to ingress only. If you need ingress and egress, you will need to mirror the ports. If multiple VLANs are present on the port, all VLANs will be mirrored.

RE: Port Mirror limitations

dflouret — Fri, 24 Apr 2015 03:48:00 GMT

Uber,

If you captured ingress and egress traffic in a VLAN you would end with duplicate traffic.

Suppose you have node A connected to port 1 and nobe B connected to port 2 and that both nodes are on the same vlan. When node A send a packet to node B the switch will mirror it when in enters the vlan (ingress) and when node B responds the switch will mirror it when the packet enters the vlan. If you mirrored traffic when it entered the vlan and when it egressed, you would have each packet mirrored twice.

Mirroring ingress and egress traffic makes sense when you apply it to a port.

Even then you have to be careful to avoid duplication of traffic. Using the previous example, if you mirrored ingress & egress in those two ports, any traffic exchanged between nodes A and B would be duplicate...

Remember that the mirrored traffic can be much higher than the capacity of the mirror port, so you want to avoid duplicate traffic.

RE: Port Mirror limitations

Tomasz_Lubas — Fri, 24 Apr 2015 11:42:00 GMT

Keep in mind that if you mirroring both directions on all ports then there is a chance that you duplicate traffic 🙂

RE: Port Mirror limitations

Kawawa — Fri, 24 Apr 2015 13:49:00 GMT

As outlined above, XOS limits to 16 Mirrors (only 4 can be active), however, each of those mirrors can have up to 128 filters defined. And each filter can be made up of ports, virtual ports or VLANS. But the best practice is to mirror traffic on the port that aggregates and egresses the traffic of those 46 ports

Re: RE: Port Mirror limitations

cborba — Wed, 28 Feb 2024 20:35:20 GMT

It means that up to 128 switch ports can be monitored by one mirror port? So in the example above, It's possible all the 47 ports be monitored by one? I have the same question because I'm implementing a Cybersecurity solution that need monitor all the port in the Switch.