B-75
Monitoring and Analyzing Switch Operation
Traffic Mirroring
Figure B-40. Effect of Downstream VLAN Tagging on the MTU for Mirrored Traffic
Operating Notes
■
Mirroring Dropped Traffic:
Where an interface is configured to mirror-
ing traffic to a destination, it does so regardless of whether the traffic is
dropped while on the interface. For example, if an ACL configured on a
VLAN with a
deny
ACE that eliminates packets from a Telnet application,
the switch still mirrors the Telnet packets it receives on the interface and
subsequently drops.
■
Mirroring and Spanning Tree:
Mirroring is done regardless of the
spanning-tree (STP) state of a port or trunk. This means, for example, that
inbound traffic on a port blocked by STP can still be monitored for STP
protocol packets during the STP setup phase.
■
Tagged and Untagged Frames:
For a frame entering or leaving the
switch on a mirrored port, the mirrored copy retains the tagged or
untagged state the original frame carried when it entered into or exited
from the switch. (The tagged or untagged VLAN membership of ports in
the path leading to the mirroring destination does not affect the tagged or
untagged status of the mirrored copy itself.) Thus, if a tagged frame arrives
on a mirrored port, the mirrored copy will also be tagged, regardless of
the status of ports in the destination path. If a frame exits from the switch
on a mirrored port that is a tagged member of a VLAN, then the mirrored
copy will also be tagged for the same reason.
3500yl
Mirror Source
Router in the
Mirror Path
8212zl
Remote
Mirror
Destination
Traffic
Analyzer
Untagged 1 Gbps
VLAN Links
3500yl
Mirror Source
6200yl
Aggregator
Due to VLAN tagging on the 10 Gbps link,
untagged traffic from the mirror sources must
be at least 4 bytes smaller than the MTU for
the path to the mirror destination.
1Gbps
Tagged 10 Gbps VLAN link.
Adds 4 bytes to each frame.
3500-5400-6200-8200-MCG-Jan08-K_13_01.book Page 75 Monday, January 28, 2008 10:04 AM