Learn network port mirroring technology in 3 minutes

Today we come to understand the network port mirroring technology.

Port mirroring is to copy the packets of the specified port (source port), VLAN (source VLAN) or CPU (source CPU) to other ports (destination ports). The destination port will be connected to the data monitoring device, and the user will use these data to monitor The device analyzes the packets copied to the destination port for network monitoring and troubleshooting. Without seriously affecting the normal throughput of the source port, the network traffic can be monitored and analyzed through the mirror port.

Source port: It is the monitored port, and the user can monitor and analyze the packets passing through the port.

Source VLAN: It is the VLAN to be monitored. Users can monitor and analyze the packets passing through all ports of this VLAN.

Source CPU: The CPU on the monitored board. The user can monitor and analyze the packets passing through the CPU.

Destination port: It can also be called a monitoring port. This port forwards the received message to the data monitoring device for monitoring and analysis of the message.

Mirror direction:

Incoming direction: Only the packets received from the source port/source VLAN/source CPU are mirrored.

Outgoing direction: Only the packets sent from the source port/source VLAN/source CPU are mirrored.

Bidirectional: Mirror the packets received and sent from the source port/source VLAN/source CPU.

According to the division of mirroring functions, port mirroring is divided into two types:

Flow mirroring: If ACL is configured and enabled on the port, it is considered to be flow mirroring. Flow mirroring only collects data packets filtered by ACL, otherwise it is regarded as pure port mirroring. For ACL traffic collection methods, it is supported to bind standard access lists and extended access lists in the direction of the port (outgoing, incoming, and bidirectional).

Pure port mirroring: mirror the traffic in and out of the port.

 

According to the scope of mirroring work, port mirroring is divided into two types:

Local mirroring: The source port and destination port are on the same router.

Remote mirroring: The source port and the destination port are distributed on different routers, and the mirrored traffic is encapsulated to achieve cross-router transmission.

The implementation of local port mirroring:

Local port mirroring can mirror all messages (including protocol messages and data messages). It is realized by a local mirroring group, that is, the source port/port in the source VLAN/source CPU and destination port are mirrored locally In the group, the device copies the packets from the source port (or source VLAN) and forwards them to the destination port. The local mirroring group supports cross-board mirroring, that is, the destination port and the source port/port/source CPU in the source VLAN can be on different boards of the same device.


Remote mirroring is divided into cross-layer 2 remote port mirroring and cross-layer 3 remote port mirroring:

Cross-Layer 2 remote port mirroring:

Cross-Layer 2 remote port mirroring can mirror all messages except protocol messages. It is realized by the cooperation of the remote source mirroring group and the remote destination mirroring group.

The user creates a remote source mirroring group on the source device and a remote destination mirroring group on the destination device. The source device copies the source port/source VLAN/source CPU message, broadcasts it in the remote mirroring VLAN through the reflection port, and sends it to the destination device via the intermediate device. After the destination device receives the message, if its VLAN ID is the same as the VLAN ID of the remote mirroring VLAN of the remote destination mirroring group, it forwards it to the destination port.

In this way, the data monitoring device connected to the destination port can monitor and analyze the source port/source VLAN/source CPU packets on the source device. The user needs to ensure the interoperability of the Layer 2 network between the source device and the destination device in the remote mirroring VLAN.

Since the source port/source VLAN/source CPU message will be broadcast in the remote mirroring VLAN of the source device, the local port mirroring function can be realized by adding other ports on the source device to the remote mirroring VLAN.

Mirroring across three layers of remote ports:

Cross-Layer 3 remote port mirroring can mirror all messages except protocol messages. It is realized by the cooperation of remote source mirroring group, remote destination mirroring group and GRE tunnel.

The above is the news sharing from the PASSHOT. I hope it can be inspired you. If you think today' s content is not too bad, you are welcome to share it with other friends. There are more latest Linux dumps, CCNA 200-301 dumps, CCNP Written dumps and CCIE Written dumps waiting for you.

Comments

Post a Comment

Popular posts from this blog

How to choose Cisco dumps?

Image
In this era of lack of trust between people, if you want to buy one thing, in addition to buying on a platform such as a regular platform, such as Amazon. Do you still believe in other self-built platforms? I believe many people have the experience of being cheated. lowest The means of defrauding money is: Your good friend comes to borrow money from you, and you have a relationship card with you so that you can lend him money. At this time, according to the normal person’s thinking, this friend has known me for many years that he might not take the money away. Note that it is often the same idea that gives others the opportunity to owe money. If the amount borrowed is not high, then it is okay. Once the amount you borrowed is too large, you should be careful and your money may not be returned! Back to the topic, in this era of lack of trust, how to choose the Cisco dumps have become an important topic. First, when you buy it depends on whether the website's URL link is https
Read more

What is proxy communication?

Image
Is it correct to understand the working level of forward proxy reverse proxy transparent proxy? Forward proxy and reverse proxy (application load balancing, some NG reverse proxy) can be understood as a man-in-the-middle mode. At the same time, both ends establish a TCP connection, and then the man-in-the-middle performs TCP connection between the two ends. Can a transparent proxy be understood as a simple and crude "hijacking" of a passing data packet, without splitting the complete TCP connection into two independent segments. So, in this sense, this kind of transparent proxy is similar to the working hierarchy of NAT devices? Preface I once saw a person write tens of thousands of words to answer a question, and read it after three days. Shocked, what is all this for? These words can produce a book, and it is also a reward for your hard work. However, I think the man has always been happy, but there is no doubt that his reputation (Reputation) is in full swin
Read more

What are CCNP Data Center jobs in Dubai?

Image
  What are CCNP Data Center jobs in Dubai? Over the last few years, Cisco accreditations have gotten popular astonishingly. Undoubtedly, Cisco certifications would be deemed the outright most necessary certificates in the field of computer system networking. About Cisco certifications, there would be an extensive range of choices. To help your career and assist you in opening brand-new doors in your career, you need the ideal accreditations. Cisco introduced its primary certification program in 1998. The essential idea behind the accreditations was to supplement the CCIE or Cisco Certified Internetwork Expert program. Cisco would have extended its qualifications and supplies lots of certifications for experts of all experience levels from that point forward. CCNP Overview: CCNP or Cisco Certified Network Professional is considered the certification available for IT specialists with one year of expert experience in computer system networking. A diploma or equivalent in a significant fie
Read more