Hello, I'm trying to find an issue within my network. At random times during the day, port utilization spikes to 100%. I am trying to mirror a port that spikes so I can see what it is that it is receiving. When setting up the mirror these are the commands I use; Create mirror "Orsett" to port "38" configure mirror "Orsett" add port "7" enable mirror "Orsett" For some reason I am not only seeing the traffic associated with the port but also the traffic to which the port is a member of a vlan. When using wireshark I can see all traffic on the vlan associated with the port rather than just port traffic? This isnt helpful as I want to target the specific port rather than the VLAN? I dont specify the vlan in the mirroring config so why does it enable it by default?
No, it mirrors ALL traffic, that comes to port, but not that traffic, that goes through vlan. You probably see some kind of broadcast/multicast traffic, e.g. ARP or DHCP requests/replies
You do want to see, what kind of traffic utilizes a 100% of the port, right? So, you see all the traffic that comes to port. It could be a multicast issue, for example.
