This knowledge base composed by MiniTool introduces a network switch technology named port mirroring to you. It involves the meaning, functions, advantages, as well as restrictions of port mirroring.
Define Port Mirroring
What Is Port Mirroring?
Port mirroring is a process that sends a copy of network packets seen on one network switch port or an entire VLAN (Virtual Local Area Network) to a network monitoring connection on another switch port where the packets can be analyzed. It is used on a network switch for network appliances requiring monitoring of network traffic like an IDS (intrusion detection system), passive probe, or RUM (Real User Monitoring) technique used for supporting APM (Application Performance Management).
Network administrators or engineers make use of the port mirroring to analyze and debug data or diagnose errors on a network. Port mirroring assists network administrators to keep a close eye on network performance and alerts them when problems appear. It can also be applied to mirror both outbound and inbound traffic on single or multiple interfaces.
Port mirroring on a Cisco System switch is in general referred to as SPAN (Switched Port Analyzer) or RSPAN (Remote Switched Port Analyzer). There are different names for it on other vendors such as RAP (Roving Analysis Port) for 3Com switches. Port mirroring is supported by nearly all enterprise-class switches, also managed switches.
Network switches support port mirroring:
- CISCO
- Dell
- D-Link
- HP
- Juniper
- Linksys
- Netgear
- Sonicwall
- TP-Link
How Does Port-Mirroring Work?
A port mirror copies Layer 3 IP traffic to an interface. On routers that contain an Internet Processor II ASIC (Application-Specific Integrated Circuit) or T Series Internet Processor, porting mirroring copies Unicast packets entering or exiting a port or packets entering a VLAN. Then, it sends those copies to a local interface for local monitoring or sends them to a VLAN for remote monitoring.
Packets that can be copied by port mirroring:
- All packets that enter or exit an interface in any combination. Copies of packets entering some interfaces and packets exiting other interfaces can be sent to the same local interface or VLAN.
- Any or all packets entering a VLAN but not packets exiting a VLAN.
- A firewall-filtered sample of packets entering a port or VLAN.
Port Mirroring vs Traffic Sampling
Port mirroring is different from traffic sampling. In traffic sampling, a sampling key based on the IPv4 header is sent to the Routing Engine, where a key is placed in a file or cflowd. Packets based on that key are sent to a cflowd server. While in port mirroring the whole packet is copied and sent out via the specified interface where it can be captured and analyzed in detail.
You can configure both port mirroring and traffic sampling, setting an independent run-length and sampling rate for port-mirrored packets. Yet, if a packet is chosen for both port mirroring and traffic sampling, only port mirroring is executed for it takes precedence.
General Switch vs Port Mirroring Switch
With a regular switch, the network traffic is visible only to computers that directly participate in a communication. Other computers that don’t join the communication won’t see the traffic. While port mirroring switch enables a particular computer connected to it to see the network traffic of all machines that are connected to the same switch or within the VLAN.
Port Mirroring Performance Limitation
Mirroring only the packets needing analysis reduces the possibility of reducing overall performance. If you mirror traffic from multiple ports, the mirrored traffic may exceed the capacity of the output interface. Then, the overflow packets are dropped.
Therefore, it is recommended to limit the amount of mirrored traffic by choosing specific interfaces and avoid using all keywords. Also, you can restrict the amount of mirrored traffic through a firewall filter to send specific traffic to the mirroring instance.
True egress mirroring is defined as mirroring the exact number of copies and the exact packet modifications that went out of the egress switched port.
About The Author
Position: Columnist
Helen Graduated from university in 2014 and started working as a tech editor in the same year. Her articles focus on video creation, editing, and conversion. She also has a good knowledge of disk management and data backup & recovery. Through an in-depth exploration of computer technology, Helen has successfully helped thousands of users solve their annoying problems.