Is it possible to do port mirroring on the ISR G2

Is it possible to create a SPAN Port on the ISR G2

First of all: why do you want to put a port in span mode ? Which is your goal and which ISR router are you using ?
Depending on what you want to do and your hardware and IOS release you can proceed in many ways:
some ISR support SPAN as far as switch module, for example
http://www.cisco.com/c/en/us/td/docs/routers/access/1800/1801/software/configuration/guide/scg/dhcpvlan.html#pgfId-1013148
http://www.cisco.com/c/en/us/td/docs/routers/access/interfaces/software/feature/guide/eesm_sw.html#wp1898606
if you are using ISO 15.0 or later configure embedded packet capturehttp://www.cisco.com/c/en/us/td/docs/ios-xml/ios/epc/configuration/15-mt/epc-15-mt-book/nm-packet-capture.html
if you need a network analysis tool for a long time, install SRE board with Prime NAM software
finally you can connect router to a switch and monitor traffic on the switch
Bye,
enrico
PS please rate if useful

Similar Messages

Configuring port mirroring on the MA561x to capture voice packets?

How to configure port mirroring on the MA561x to capture voice packets? Now I use the MA5616. Any help would be appreciated!

How to configure port mirroring on the MA561x to capture voice packets? Now I use the MA5616. Any help would be appreciated!
I use the MA5616,too,and I bought from www.huanetwork.com
, nice price. The configuration of this problem, please visit: http://momopp.blogdetik.com/

Port mirroring with ALOT of Drops Tx on a 5406zl

Hi everybody.
My first post here and I'm convinced that the questions I have will be easily answered by several of the true experts that reside here in the forum.
Question #1.
I've set up port mirroring this way on my HP procurve J8697A Switch 5406zl (Software revision K.15.12.0015)
sw-dh-1(config)# show monitor 1
Network Monitoring
   Session: 4    Session Name:
      Mirror Destination: B13   (Port)
      Monitoring Sources Direction Truncation Mirror Policy
      Port: F1            Both       No         -
      Port: F2            Both       No         -
      Port: F3            Both       No         -
      sw-dh-1# show monitor 2
Network Monitoring
   Session: 3    Session Name:
      Mirror Destination: A6    (Port)
      Monitoring Sources Direction Truncation Mirror Policy
      Port: A7            Both       No         -
      Port: B6            Both       No         -
      Port: B10           Both       No         -
      Port: Trk5          Both       No         -
      Port: Trk9          Both       No         -
      Port: Trk11         Both       No         -
See output of "show interface" below. I'm worried about "Drop Tx". What does that mean exactly? Are mirrored packets dropped or does this mean that the ordinary traffic on the monitoring ports are also affected? If yes, how? Data loss, resending packets, loss of speed, high CPU load on the switch?
sw-dh-1# show interfaces B13
Status and Counters - Port Counters for port B13
Name : <removed>
MAC Address      : xxxxxx-xxxxx
Link Status      : Up
Totals (Since boot or last clear) :
   Bytes Rx        : 576                Bytes Tx        : 4,252,895,128
   Unicast Rx      : 0                  Unicast Tx      : 3,440,299,294
   Bcast/Mcast Rx : 9                  Bcast/Mcast Tx : 412,639,331
Errors (Since boot or last clear) :
   FCS Rx          : 0                  Drops Tx        : 29,441,235
   Alignment Rx    : 0                  Collisions Tx   : 0
   Runts Rx        : 0                  Late Colln Tx   : 0
   Giants Rx       : 0                  Excessive Colln : 0
   Total Rx Errors : 0                  Deferred Tx     : 0
Others (Since boot or last clear) :
   Discard Rx      : 0                  Out Queue Len   : 0
   Unknown Protos : 0
Rates (5 minute weighted average) :
   Total Rx (bps) : 0                  Total Tx (bps) : 5,002,088
   Unicast Rx (Pkts/sec) : 0            Unicast Tx (Pkts/sec) : 0
   B/Mcast Rx (Pkts/sec) : 0            B/Mcast Tx (Pkts/sec) : 6
   Utilization Rx :     0 %            Utilization Tx : 0.50 %
sw-dh-1# show interfaces A6
Status and Counters - Port Counters for port A6
Name : <removed>
MAC Address      : xxxxx-xxxxx
Link Status      : Up
Totals (Since boot or last clear) :
   Bytes Rx        : 960                Bytes Tx        : 1,442,037,177
   Unicast Rx      : 0                  Unicast Tx      : 1,988,961,810
   Bcast/Mcast Rx : 15                 Bcast/Mcast Tx : 339,915,002
Errors (Since boot or last clear) :
   FCS Rx          : 0                  Drops Tx        : 1,647,165,303
   Alignment Rx    : 0                  Collisions Tx   : 0
   Runts Rx        : 0                  Late Colln Tx   : 0
   Giants Rx       : 0                  Excessive Colln : 0
   Total Rx Errors : 0                  Deferred Tx     : 0
Others (Since boot or last clear) :
   Discard Rx      : 0                  Out Queue Len   : 0
   Unknown Protos : 0
Rates (5 minute weighted average) :
   Total Rx (bps) : 0                  Total Tx (bps) : 5,000,000
   Unicast Rx (Pkts/sec) : 0            Unicast Tx (Pkts/sec) : 0
   B/Mcast Rx (Pkts/sec) : 0            B/Mcast Tx (Pkts/sec) : 0
   Utilization Rx :     0 %            Utilization Tx : 0.50 %
Utilzation and total last 5 minutes is off since I turned the mirroring off when I saw the drops. Utilization when port mirroring was on was 20-35%.
Question #2:
Is it better if I mirror out all traffic to the 10GB port instead? Assuming that it is possible to do port mirroring to the 10GB port?
best regards,
Dean Y

You don;t indicate which router you have, but that doesn;t really matter.Neither the Actiontec MI424-WR or the Quantum G1100 have port mirroring.  You need qan old fashioned hub, or a managed switch that supports it.

Port mirroring on SG300 questions

Hi all,
I'm troubleshooting a LAN issue I have, and I wanted to hook up wireshark to record traffic over the course of a couple of hours for later diagnostics. I went into the web administration interface, clicked Administration > Diagnostics > Port and VLAN Mirroring, and added a port mirror from the port I wanted to watch to a port to which I had connected a laptop. I picked the Tx and Rx options, and clicked Apply.
I did receive lots of traffic in wireshark, but I noticed immediately that the server on the port I had mirrored was suddenly unavailable on the network -- pings timed out. This lasted until I removed the mirror, then the server was suddenly reachable once again.
Does this feature not work the way I had thought it does? What I saw looked more like a forward than what I would call a mirror. The documentation leads me to believe mirroring is intended to be used in just the way I was attempting to use it.
Am I missing something?

Hi Lamint,
I have a SG300-10P for my test, I did the same thing you did in my GUI.
I was mirroring port 7 to port 8 ticking the item to mirror RX and TX
My PC with wireshark was residing on port 8.
I started a comtinuous oibg from my PC on port 7 at IP address 192.168.10.60 to my WAN routers LAN address, 192.168.10.1 .
As you can see from my screen capture below, my PC on port 8 caprtured both RX and TX packets on port 7.
Because my wireshark PC was on port 8, I could not access the management interface of the switch to show you my configuration, so I grabbed the configuration via hyperterminal.
See screen caopture below ( with some configuration items excluded)..
I would suggest, if you are having issues to allow the Small Business Support Center to assist you.
http://www.cisco.com/en/US/support/tsd_cisco_small_business_support_center_contacts.html
Hope this helps
regards Dave

Port mirroring on A90-9100EM15-10

Hey all -
I have the A90-9100EM15-10 FiOS router and I'd like to setup port mirroring from the router if it has the capability (I know, I know...this is typically done from a switch). Anyway, rather than purchase a managed switch or build a linux-based "switch" and place it inline, I'd be content with the ability to passively monitor traffic. I prefer to monitor traffic both directions but outgoing would suffice.
Does anyone know if my model FiOS router has such a capability?
Cheers,
Eneg

The 9100EM does not support port mirroring.
You might want to find a hub and use that to mirror the traffic.
http://shop.ebay.com/?_from=R40&_trksid=p5197.m570.l1313&_nkw=ethernet+hub&_sacat=See-All-Categories
Be careful though, many of those listed claim to be hubs are not and are in fact switches.

SLM2024 port mirroring breaks network connections

Hi all, I got an SLM2024 that I want to use with my network probe app to analyze packets, I have my network probe PC plugged into the target port and uplink to firewall's trusted port to source port of 2024. Now whenever I enable port mirroring on the 2024, I lose all network connections on the 2024, I searched around here but didn't really find my answer. If anyone's seen this before, any pointers would be great.

Hi Crash, thanks for the reply, yeah it's a similar setting on that model just with a different layout on the admin page, what I meant on the trusted port part is, I have a netscreen firewall and the trusted port of the firewall goes into the source mirrored port of the slm2024, and my PC is on the target port. And I have those mirrored with a setting for both tx and rx, whenever I enable mirroring it halts traffic from the firewall, and others that are on the 2024 like server/workstns.
But network probe works and I can see traffic. We had a cisco catalyst before and that had no problems using the span feature.

RV180 Port Mirroring

Has anyone had any success with port mirroring on the RV180?
The data sheet refers to port mirroring capability, but I can't find the configuration settings anywhere?

Duplicate posts.
Go here: http://supportforums.cisco.com/discussion/12156511/rv180-port-mirroring

VSphere Port Mirror - Possible Bug Found

Hi,
Something i came across to and thought could be worth while reporting it since i havent seen any reference to it elsewhere:
We've configured a few "source remote port mirror rules" for a few VMs, in a way that each VM had 3 vNics that were mirrored.
long story shot: one VM had one vNic that was E1000 and not VMXNET3 like all the others, each time i enabled the "source remote port mirror" rule for the E1000 vNic, all other port mirrors (from this VM and other VMs located on the same ESX) stopped working. problem was solved after i removed the vNic and created a new one, this time a VMXNET3 vNic.
didnt see any reference about E1000/VMXNET3 regarding vSphere Port Mirroring. New bug maybe?

Hi,
Something i came across to and thought could be worth while reporting it since i havent seen any reference to it elsewhere:
We've configured a few "source remote port mirror rules" for a few VMs, in a way that each VM had 3 vNics that were mirrored.
long story shot: one VM had one vNic that was E1000 and not VMXNET3 like all the others, each time i enabled the "source remote port mirror" rule for the E1000 vNic, all other port mirrors (from this VM and other VMs located on the same ESX) stopped working. problem was solved after i removed the vNic and created a new one, this time a VMXNET3 vNic.
didnt see any reference about E1000/VMXNET3 regarding vSphere Port Mirroring. New bug maybe?

Add VM to a Port Mirroring Session

I need every VM added to a given folder in vCenter to be added to an existing distributed switch port mirroring session. Is this possible using PowerCLI?

The following will add the VM ($vmName) to a specific port mirroring session ($mirrorSessionName) on a distributed switch ($dvSwName).
You can define the traffic direction(s) for which the VM needs to be added with the variables $Ingress and $Egress.
Note that there isn't any error checking in the script.
For example if the mirror session does not exist, the script will fail without an informative messages.
To repeat this script for all VMs in a specific folder should be not too difficult, I assume ?
$dvSwName = 'dvSw1'
$mirrorSessionName = 'Test'
$vmName = 'VM2'
$Ingress = $false
$Egress = $true
$dvSw = Get-VDSwitch -Name $dvSwName
$vm = Get-VM -Name $vmName
$vmNic = $vm.ExtensionData.Config.Hardware.Device |
    where{$_.Backing -is [VMware.Vim.VirtualEthernetCardDistributedVirtualPortBackingInfo]}
$spec = New-Object VMware.Vim.VMwareDVSConfigSpec
foreach($mirrorSession in $dvSw.ExtensionData.Config.VspanSession){
    if($mirrorSession.Name -eq $mirrorSessionName){
        $vspan = New-Object VMware.Vim.VMwareDVSVspanConfigSpec
        $vspan.Operation = [VMware.Vim.ConfigSpecOperation]::edit
        $vmInRc = $mirrorSession.SourcePortReceived | where{$_.PortKey -contains $vmNic.Backing.Port.PortKey}
        if($Ingress -and !$vmInRc){
            $mirrorSession.SourcePortReceived.PortKey += $vmNic.Backing.Port.PortKey
        $vmInTx = $mirrorSession.SourcePortTRansmitted | where{$_.PortKey -contains $vmNic.Backing.Port.PortKey}
        if($Egress -and !$vmInTx){
            $mirrorSession.SourcePortTransmitted.PortKey += $vmNic.Backing.Port.PortKey
        $vspan.vspanSession = $mirrorSession
        $spec.vspanConfigSpec += $vspan
$spec.ConfigVersion = $dvSw.ExtensionData.Config.ConfigVersion
$dvSw.ExtensionData.ReconfigureDvs($spec)

Port mirroring in routers

Hi,
Port mirroring(SPAN) is possible in Switches, let me know if there is any sorts of feature implemented in Routers...
Cheers
Akhtar

Cisco has added a new feature that supports mirroring traffic on a router called IP traffic export. You need to run IOS version 12.3(4)T or later.
Check out the link below for configuration guidelines:
http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_chapter09186a0080455b94.html
HTH,
Sundar
*Please rate all helpful posts.

Hyper-V WMI Provider - Searching and Setting Port Mirroring

Is there any way to search for VMs with Port Mirroring disabled through WMI provider?? I'm working on a little application to set port mirroring to destination but I can't find anything in WMI Provider API. I know this can be achieved using PowerShell
cmdlets but I would rather use WMI and C# if possible. Thanks.

Hi PerlFanatic ,
Please refer to following command :
Get-WmiObject -Namespace root\virtualization\v2 -Class msvm_ethernetswitchportsecuritysetting
data
Best Regards
Elton JI
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

SGE2000P 24 ports - Port Mirroring limitation

Hi everybody,
I need to setup port mirroring on several ports on a SGE2000P 24 port switch.
I easily managed to setup 1 session (1 target port) listening to 8 ports (source ports) but it seems like I can't add any more port.
Line No.
Error Type
Value
Diagnostic
1
Unknown value
Too many monitoring sessions..
I went through the switch documentation and I could not find any information regarding limitations on the number of mirrored ports.
Is anyone aware and can confirm this limit?
If this is the case, is it possible to setup more than one session (target port)?
Thank you,
Roberto

These switches only support 1 session only with 8 source ports to 1 destination port.
Best Regards,

Is it possible to get airplay mirror capability on Mac OS X Lion 10.7.5?

Is it possible to get the Airplay mirroring capability on Mac OS X Lion 10.7.5? If not what are the best options for obtaining the mirroring feature?

Hello! It's not possible to get Airplay Mirroring. There are 3rd-party options, the most well-know being Airparrot. http://www.airsquirrels.com/airparrot/

Trouble With Port Mirroring (SG200-08)

Trouble with port mirroring.
Even though both Tx and Rx is specified, only getting half the conversation. Ping reply only for instance. And when pinging from other locations no traffic at all.
Please help
SG200-008
FW Version: 1.0.2.0
Boot Version D.3.1
Thanks

I also have problem with the mirroring of port on my SG200-08. The firmware is 1.0.6.2.
I mirror the port g1, to which my router to the Internet is connected, to the port g2 to be able to see the traffic with a Centos system running Bandwidthd connected to the port g2. The problem is that I only see the traffic coming in (downloads from the Internet) and not the traffic comming out (uploads to the Internet).
When looking at the SG 200-08 on the web interface at "Status and Statistics/Interface" and looking at the port g2, I see values for the "Transmit Statistics", but all the values are at 0 for the "Received Statisticsc" (see the attached file)
I confirmed that in "Administration/Diagnostic/Port Mirroring" is set up both Tx and Rx (it does not work either if I have Tx or Rx alone: I do not see the uploda traffic to the Internet). See the attached file.
This is very annoying as I purchased this SG 200-08 especially for this and it does not do the job porperly.
Does anybody knows a solution to this?

Cat 3750-Span (Port Mirroring issue)

Hello team
I am facing port mirroring issue in my setup. Details of the setup are mentioned below
Setup--
Stack of 4 catalyst switches WS-C3750X-48P running software 15.0(1) SE3 .Approximately 12 vlans are configured in this setup and port mirroring is done for all vlans with destination configured as single Gig Ethernet port...The setup works fine from mirroring perspective for 3-4 days and after that machine connected to destination port stops getting data.
Observations-
It has been observed that during the issue, the port configured for mirror destination has lot of packet drop/input errors on the port statistics.
If we configure only TX packet mirroring, it works for 8 -10 days
If we configure TX & RX packet mirroring, it works for 2-3 days
Testing done
Tried clearing counter on destination port but no success (mirroring doesn’t start)
Tried shut /no shut for the destination port but no success.
Tried restarting the machine connected to destination port but no success
Workaround
We need to reconfigure the mirroring configuration after removing the mirroring config from the switch. Once the same is done, mirroring starts working.
Want to understand
1-is there any HW limitation for the switch (destination port not capable of handling mirroring traffic)
2-is there any software related issue?
3-what can be permanent resolution for the same..

Hello
We have tried this previously but found same result.
1- we deleted the monitror session and recreated again with same session number
2-we deleted the monitor session and created new session (session id diffrent ) with same config..
in both cases its working for 3-4 days..

Is it possible to do port mirroring on the ISR G2

Similar Messages

Maybe you are looking for