Port mirroring
Encyclopedia
Port Mirroring is used on a network switch
to send a copy of network
packets seen on one switch port (or an entire VLAN) to a network monitoring connection on another switch port. This is commonly used for network appliances that require monitoring of network traffic, such as an intrusion-detection system
. Port mirroring on a Cisco Systems
switch is generally referred to as Switched Port Analyzer (SPAN); some other vendors have other names for it, such as Roving Analysis Port (RAP) on 3Com
switches.
A network Engineer or Administrator use port mirroring to diagnose error in network , analyse or debug data.
Its help the administrator to keep close eye on network performance and alert if required.
It can be use to mirror either inbound or outbound traffic on single or multiple interfaces
An example of a SPAN configuration on a Cisco 2950 Switch is below.
The above example mirrors data from ports 0/1, 0/2 and 0/3 to the destination port 0/4 using vlan1 for vlan tagging.
To show the status of a SPAN monitor session use the following command.
...where 1 is the session number from the above statement...
Network switch
A network switch or switching hub is a computer networking device that connects network segments.The term commonly refers to a multi-port network bridge that processes and routes data at the data link layer of the OSI model...
to send a copy of network
Computer network
A computer network, often simply referred to as a network, is a collection of hardware components and computers interconnected by communication channels that allow sharing of resources and information....
packets seen on one switch port (or an entire VLAN) to a network monitoring connection on another switch port. This is commonly used for network appliances that require monitoring of network traffic, such as an intrusion-detection system
Intrusion-detection system
An intrusion detection system is a device or software application that monitors network and/or system activities for malicious activities or policy violations and produces reports to a Management Station. Some systems may attempt to stop an intrusion attempt but this is neither required nor...
. Port mirroring on a Cisco Systems
Cisco Systems
Cisco Systems, Inc. is an American multinational corporation headquartered in San Jose, California, United States, that designs and sells consumer electronics, networking, voice, and communications technology and services. Cisco has more than 70,000 employees and annual revenue of US$...
switch is generally referred to as Switched Port Analyzer (SPAN); some other vendors have other names for it, such as Roving Analysis Port (RAP) on 3Com
3Com
3Com was a pioneering digital electronics manufacturer best known for its computer network infrastructure products. The company was co-founded in 1979 by Robert Metcalfe, Howard Charney, Bruce Borden, and Greg Shaw...
switches.
A network Engineer or Administrator use port mirroring to diagnose error in network , analyse or debug data.
Its help the administrator to keep close eye on network performance and alert if required.
It can be use to mirror either inbound or outbound traffic on single or multiple interfaces
An example of a SPAN configuration on a Cisco 2950 Switch is below.
Monitor session 1 source interface fastethernet 0/1 , 0/2 , 0/3
Monitor session 1 destination interface fastethernet 0/4 encap ingress vlan 1
The above example mirrors data from ports 0/1, 0/2 and 0/3 to the destination port 0/4 using vlan1 for vlan tagging.
To show the status of a SPAN monitor session use the following command.
show monitor session 1
...where 1 is the session number from the above statement...