B-76
Monitoring and Analyzing Switch Operation
Traffic Mirroring
■
Effect of IGMP on Mirroring:
If both inbound and outbound mirroring
is operating when IGMP is enabled on any VLAN, two copies of mirrored
IGMP frames may appear at the mirroring destination.
■
Mirrored Traffic Not Encrypted:
Mirrored traffic undergoes IPv4
encapsulation, but mirrored, encapsulated traffic is not encrypted.
■
IPv4 Header Added:
The IPv4 encapsulation of mirrored traffic adds a
54-byte header to each mirrored frame. If a resulting frame exceeds the
maximum MTU allowed in the network, it will be dropped. To reduce the
number of dropped frames, enable jumbo frames in the mirroring path,
including all intermediate switches and/or routers. (The maximum trans-
mission unit—MTU—on the switch is 9220 bytes, which includes 4 bytes
for the 802.1Q VLAN tag.) For more information, refer to “Maximum
Supported Frame Size” on page B-73. To configure the switch for jumbo
frames, refer to “Configuring Jumbo Frame Operation” on page 13-29.
■
Intercepted or Injected Traffic:
The mirroring feature does not protect
against either mirrored traffic being intercepted or traffic being injected
into a mirrored stream by an intermediate host.
■
Inbound Mirrored IPv4-Encapsulated Frames are Not Mirrored:
The switch does not mirror IPv4-encapsulated mirrored frames that it
receives on an interface. This prevents duplicate mirrored frames in
configurations where the port connecting the switch to the network path
for mirroring to a destination is also a port whose inbound or outbound
traffic is being mirrored. For example, if traffic leaving the switch through
ports B5, B6, and B7 is being mirrored through port B7 to a network
analyzer, the mirrored frames from traffic on ports B5 and B6 will not be
mirrored a second time as they pass through port B7.
■
Switch Operation as Both Destination and Source:
A switch config-
ured as remote destination switch can also be configured to mirror traffic
to one of its own ports (local mirroring) or to a destination on another
switch (remote mirroring).
■
Monitor Command Note:
If session 1 is already configured with a
destination, you can execute
[no] vlan < vid > monitor
or
[no] interface
< port > monitor
without mirroring criteria and a mirror session number. In
this case, the switch automatically configures or removes mirroring for
inbound and outbound traffic from the specified VLAN or port(s) to the
destination configured for session 1.
■
Loss of Connectivity Suspends Remote Mirroring:
When a remote
mirroring session is configured on a source switch, the switch sends an
ARP request to the configured destination approximately every 60 sec-
onds. If the source switch fails to receive the expected ARP response from
the destination for that session, transmission of mirrored traffic for the
session halts. However, because the source switch continues to send ARP
3500-5400-6200-8200-MCG-Jan08-K_13_01.book Page 76 Monday, January 28, 2008 10:04 AM