8. Traffic
Monitoring
MN700004 Rev 01
68
Traffic Types
A monitor session includes the following traffic types:
•
Receive (Rx)
- The goal of receive (or ingress) monitoring is to monitor the packets
received by the source interface or VLAN before any modification or processing is
performed by the switch. A copy of each packet received by the source is sent to the
destination port that monitors the session. At the destination port, if the packet is
tagged, it will appear with the 802.1Q header.
•
Transmit (Tx)
- The goal of transmit (or egress) monitor session is to monitor as
much as possible all the packets sent by the source interface after all modification and
processing is performed by the switch. A copy of each packet sent by the source is
sent to the destination port for that monitor session. The copy is provided after the
packet is modified.
Source Port
A source port (also called a monitored port) is a switched or routed port that you monitor for
network traffic analysis. In a single local monitor session, you can monitor source port traffic
such as received (Rx), transmitted (Tx), or bidirectional.
On the Rx the switch supports any number of source ports up to the maximum number of
available ports on the switch, and any number of source VLANs up to the maximum number
of VLANs supported.
On the Tx the switch supports up to eight source ports.
A source port has the following characteristics:
•
It can be any port type (for example, Fast Ethernet, Gigabit Ethernet, link aggregation
group and so forth).
•
It cannot be a destination port.
•
Each source port can be configured with a direction (Rx, Tx, or both) to monitor.
•
Source ports can be in the same or different VLANs.
For VLAN monitor sources, all active ports in the source VLAN are included as source ports.
Destination Port
Each local monitor session must have a destination port (also called a monitoring port) that
receives a copy of traffic from the source ports and VLANs.
The destination port has the following characteristics:
•
It must reside on the same switch as the source port.
•
It can be any Ethernet physical port.
•
It cannot be a source port.
NOTE
The destination port is limited to its capacity. All traffic that exceeds the port's capacity will
be dropped.