When I mirror several vLANs toward a port, I can see all broadcast traffic but no unicast traffic. It's a little bit like if the monitoring port had been inclded in the vLANs mirrored but no mirroring happen at all...
Is there some configuration I missed or some limitation here ?
here is the configuration used :
create mirror "VNF9"
configure mirror VNF9 to port 45
enable mirror VNF9
configure mirror VNF9 add vlan VNF09_IAC_R1 ingress
configure mirror VNF9 add vlan VNF09_MEDIA_R1 ingress
configure mirror VNF9 add vlan VNF09_MGMT_R1 ingress
configure mirror VNF9 add vlan VNF09_OM_CN_R1 ingress
configure mirror VNF9 add vlan VNF09_PRAN_R1 ingress
configure mirror VNF9 add vlan VNF09_SIGNALING_R1 ingress
configure vlan VNF09_IAC_R1 description "mbb_gwc01"
configure vlan VNF09_IAC_R1 tag 2094
create vlan "VNF09_MEDIA_R1"
configure vlan VNF09_MEDIA_R1 description "mbb_gwc01"
configure vlan VNF09_MEDIA_R1 tag 2092
create vlan "VNF09_MGMT_R1"
configure vlan VNF09_MGMT_R1 description "mbb_gwc01"
configure vlan VNF09_MGMT_R1 tag 2095
create vlan "VNF09_OM_CN_R1"
configure vlan VNF09_OM_CN_R1 description "mbb_gwc01"
configure vlan VNF09_OM_CN_R1 tag 2093
create vlan "VNF09_PRAN_R1"
configure vlan VNF09_PRAN_R1 description "mbb_gwc01"
configure vlan VNF09_PRAN_R1 tag 2090
create vlan "VNF09_SIGNALING_R1"
configure vlan VNF09_SIGNALING_R1 description "mbb_gwc01"
configure vlan VNF09_SIGNALING_R1 tag 2091
configure vlan VNF09_IAC_R1 add ports 2-8, 26-32, 48 tagged
configure vlan VNF09_MEDIA_R1 add ports 2-8, 26-32, 48 tagged
configure vlan VNF09_MGMT_R1 add ports 2-8, 26-32, 48 tagged
configure vlan VNF09_OM_CN_R1 add ports 2-8, 26-32, 48 tagged
configure vlan VNF09_PRAN_R1 add ports 2-8, 26-32, 48 tagged
configure vlan VNF09_SIGNALING_R1 add ports 2-8, 26-32, 48 tagged
And here is an extract of a capture while a ping is running on one of these vLANs (only broad cast are catched) :
17:29:17.846331 00:02:3b:10:12:8f > 01:00:5e:00:00:05, ethertype 802.1Q (0x8100), length 102: vlan 2092, p 0, ethertype IPv4, (tos 0xc0, ttl 1, id 1420, offset 0, flags [none], proto OSPF (89), length 84)
21.21.9.22 > 224.0.0.5: OSPFv2, LS-Update, length 64
Router-ID 1.1.1.6, Area 0.0.0.3, Authentication Type: none (0), 1 LSA
LSA #1
Advertising Router 21.21.10.17, seq 0x80000004, age 2s, length 16
External LSA (5), LSA-ID: 21.21.10.161
Options: [External, Demand Circuit]
Mask 255.255.255.255
topology default (0), type 2, metric 0
0x0000: ffff ffff 8000 0000 0000 0000 0000 0000
17:29:18.528759 00:02:3b:10:12:8f > 01:00:5e:00:00:05, ethertype 802.1Q (0x8100), length 102: vlan 2090, p 0, ethertype IPv4, (tos 0xc0, ttl 1, id 54743, offset 0, flags [none], proto OSPF (89), length 84)
21.21.9.6 > 224.0.0.5: OSPFv2, LS-Update, length 64
Router-ID 1.1.1.10, Area 0.0.0.1, Authentication Type: none (0), 1 LSA
LSA #1
Advertising Router 1.1.1.10, seq 0x8000032f, age 1s, length 16
External LSA (5), LSA-ID: 172.20.16.0
Options: [External, Demand Circuit]
Mask 255.255.255.0
topology default (0), type 1, metric 5, forward 21.21.20.1
0x0000: ffff ff00 0000 0005 1515 1401 0000 0000
Limiting the capture, we can see OSPF broadcast, ARP request (but no answers)...
17:34:10.455935 00:02:3b:10:12:8f > 01:00:5e:00:00:05, ethertype 802.1Q (0x8100), length 86: vlan 2091, p 0, ethertype IPv4, (tos 0xc0, ttl 1, id 27526, offset 0, flags [none], proto OSPF (89), length 68)
17:34:10.552442 fa:16:3e:6c:1a:c3 > 01:00:5e:00:00:05, ethertype 802.1Q (0x8100), length 86: vlan 2091, p 0, ethertype IPv4, (tos 0xc0, ttl 1, id 59158, offset 0, flags [none], proto OSPF (89), length 68)
17:34:11.278041 00:02:3b:10:12:8f > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 2095, p 6, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 21.21.9.46 (Broadcast) tell 21.21.9.46, length 46
17:34:11.278047 00:02:3b:10:12:8f > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 2093, p 6, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 21.21.9.30 (Broadcast) tell 21.21.9.30, length 46
17:34:11.278126 00:02:3b:10:12:8f > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 2095, p 6, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 21.21.9.41 (Broadcast) tell 21.21.9.46, length 46
17:34:11.278259 00:02:3b:10:12:8f > Broadcast, ethertype 802.1Q (0x8100), length 64: vlan 2093, p 6, ethertype ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 21.21.9.25 (Broadcast) tell 21.21.9.30, length 46
17:34:11.571135 fa:16:3e:1b:ae:a4 > 01:00:5e:00:00:05, ethertype 802.1Q (0x8100), length 86: vlan 2092, p 0, ethertype IPv4, (tos 0xc0, ttl 1, id 22867, offset 0, flags [none], proto OSPF (89), length 68)
17:34:12.446747 00:02:3b:10:12:8f > 01:00:5e:00:00:05, ethertype 802.1Q (0x8100), length 86: vlan 2094, p 0, ethertype IPv4, (tos 0xc0, ttl 1, id 44255, offset 0, flags [none], proto OSPF (89), length 68)
17:34:12.551103 fa:16:3e:e4:f4:d5 > 01:00:5e:00:00:05, ethertype 802.1Q (0x8100), length 86: vlan 2090, p 0, ethertype IPv4, (tos 0xc0, ttl 1, id 12804, offset 0, flags [none], proto OSPF (89), length 68)
...
Can you help please ?