Obtaining Packets from Switch Mirrored Environment
On the switch, the mirroring port and
observing port are installed. Connect the laptop with the switch through the
observing port. Start the Wireshark on the laptop to capture packets.
For details about setting the mirroring
port and observing port, see the corresponding switch product documentation or
ask Datacom personnel for help.
Relevant concepts and principles are as
follows:
1. Mirroring
port and observing port:
Mirroring
port: Indicates the port that is being monitored. All the packets that pass
through a mirroring port are copied to the observing port.
Observing
port: Indicates the port that is connected to a monitoring device and used to
send packets from the mirrored port to the monitoring device.
An
observing port is dedicated to forwarding mirrored traffic. Do not configure
other services on an observing port; otherwise, mirrored traffic and other
service traffic interfere with each other.
If the
mirroring function is deployed on many ports of a device, a great deal of
internal forwarding bandwidth will be occupied, which affects the forwarding of
other services. Additionally, if the mirrored port bandwidth is higher than the
observing port bandwidth, for example, 1000 Mbit/s on a mirrored port and 100
Mbit/s on an observing port, the observing port will fail to forward all
mirrored packets in a timely manner because of insufficient bandwidth, leading
to packet loss.
2. Mirroring
Direction
The
mirroring direction refers to the direction in which the device copies packets
on the mirrored port to the observing port:
Inbound:
The device mirrors the packets that are received by the mirrored port to the
observing port.
Outbound:
The device mirrors the packets that are sent from the mirrored port to the
observing port.
Bidirectional:
The device mirrors the packets that are received and sent by the mirrored port
to the observing port.
