Port mirroring

I want to configure port mirroring on SG300 swtich
Source Port gi10
Destination port gi1
You can see my configuration from the attached jpg file.
Problem is port monitoring status is "Not Ready" , and i can not monitor the source interface!

Hi Egemen,
I have the same thing happenning on my SG300-10P, see screen capture below.
Then I plugged some devices into ports G8 and G9.
It was noted that the status changed to the following, see screen capture below.
Check your link state on the front of the switch or use to GUI to look at the port states. If one of those two ports does not have link, the switch will report "not ready."
You may find additional useful information under status and statistics> view log >ram memory can give you details about what is happening with port states, so check your error log.
( note: logging may have to be enabled via Administration >log settings )
regards dave

Similar Messages

Trouble With Port Mirroring (SG200-08)

Trouble with port mirroring.
Even though both Tx and Rx is specified, only getting half the conversation. Ping reply only for instance. And when pinging from other locations no traffic at all.
Please help
SG200-008
FW Version: 1.0.2.0
Boot Version D.3.1
Thanks

I also have problem with the mirroring of port on my SG200-08. The firmware is 1.0.6.2.
I mirror the port g1, to which my router to the Internet is connected, to the port g2 to be able to see the traffic with a Centos system running Bandwidthd connected to the port g2. The problem is that I only see the traffic coming in (downloads from the Internet) and not the traffic comming out (uploads to the Internet).
When looking at the SG 200-08 on the web interface at "Status and Statistics/Interface" and looking at the port g2, I see values for the "Transmit Statistics", but all the values are at 0 for the "Received Statisticsc" (see the attached file)
I confirmed that in "Administration/Diagnostic/Port Mirroring" is set up both Tx and Rx (it does not work either if I have Tx or Rx alone: I do not see the uploda traffic to the Internet). See the attached file.
This is very annoying as I purchased this SG 200-08 especially for this and it does not do the job porperly.
Does anybody knows a solution to this?

Cat 3750-Span (Port Mirroring issue)

Hello team
I am facing port mirroring issue in my setup. Details of the setup are mentioned below
Setup--
Stack of 4 catalyst switches WS-C3750X-48P running software 15.0(1) SE3 .Approximately 12 vlans are configured in this setup and port mirroring is done for all vlans with destination configured as single Gig Ethernet port...The setup works fine from mirroring perspective for 3-4 days and after that machine connected to destination port stops getting data.
Observations-
It has been observed that during the issue, the port configured for mirror destination has lot of packet drop/input errors on the port statistics.
If we configure only TX packet mirroring, it works for 8 -10 days
If we configure TX & RX packet mirroring, it works for 2-3 days
Testing done
Tried clearing counter on destination port but no success (mirroring doesn’t start)
Tried shut /no shut for the destination port but no success.
Tried restarting the machine connected to destination port but no success
Workaround
We need to reconfigure the mirroring configuration after removing the mirroring config from the switch. Once the same is done, mirroring starts working.
Want to understand
1-is there any HW limitation for the switch (destination port not capable of handling mirroring traffic)
2-is there any software related issue?
3-what can be permanent resolution for the same..

Hello
We have tried this previously but found same result.
1- we deleted the monitror session and recreated again with same session number
2-we deleted the monitor session and created new session (session id diffrent ) with same config..
in both cases its working for 3-4 days..

VSphere Port Mirror - Possible Bug Found

Hi,
Something i came across to and thought could be worth while reporting it since i havent seen any reference to it elsewhere:
We've configured a few "source remote port mirror rules" for a few VMs, in a way that each VM had 3 vNics that were mirrored.
long story shot: one VM had one vNic that was E1000 and not VMXNET3 like all the others, each time i enabled the "source remote port mirror" rule for the E1000 vNic, all other port mirrors (from this VM and other VMs located on the same ESX) stopped working. problem was solved after i removed the vNic and created a new one, this time a VMXNET3 vNic.
didnt see any reference about E1000/VMXNET3 regarding vSphere Port Mirroring. New bug maybe?

Hi,
Something i came across to and thought could be worth while reporting it since i havent seen any reference to it elsewhere:
We've configured a few "source remote port mirror rules" for a few VMs, in a way that each VM had 3 vNics that were mirrored.
long story shot: one VM had one vNic that was E1000 and not VMXNET3 like all the others, each time i enabled the "source remote port mirror" rule for the E1000 vNic, all other port mirrors (from this VM and other VMs located on the same ESX) stopped working. problem was solved after i removed the vNic and created a new one, this time a VMXNET3 vNic.
didnt see any reference about E1000/VMXNET3 regarding vSphere Port Mirroring. New bug maybe?

Add VM to a Port Mirroring Session

I need every VM added to a given folder in vCenter to be added to an existing distributed switch port mirroring session. Is this possible using PowerCLI?

The following will add the VM ($vmName) to a specific port mirroring session ($mirrorSessionName) on a distributed switch ($dvSwName).
You can define the traffic direction(s) for which the VM needs to be added with the variables $Ingress and $Egress.
Note that there isn't any error checking in the script.
For example if the mirror session does not exist, the script will fail without an informative messages.
To repeat this script for all VMs in a specific folder should be not too difficult, I assume ?
$dvSwName = 'dvSw1'
$mirrorSessionName = 'Test'
$vmName = 'VM2'
$Ingress = $false
$Egress = $true
$dvSw = Get-VDSwitch -Name $dvSwName
$vm = Get-VM -Name $vmName
$vmNic = $vm.ExtensionData.Config.Hardware.Device |
    where{$_.Backing -is [VMware.Vim.VirtualEthernetCardDistributedVirtualPortBackingInfo]}
$spec = New-Object VMware.Vim.VMwareDVSConfigSpec
foreach($mirrorSession in $dvSw.ExtensionData.Config.VspanSession){
    if($mirrorSession.Name -eq $mirrorSessionName){
        $vspan = New-Object VMware.Vim.VMwareDVSVspanConfigSpec
        $vspan.Operation = [VMware.Vim.ConfigSpecOperation]::edit
        $vmInRc = $mirrorSession.SourcePortReceived | where{$_.PortKey -contains $vmNic.Backing.Port.PortKey}
        if($Ingress -and !$vmInRc){
            $mirrorSession.SourcePortReceived.PortKey += $vmNic.Backing.Port.PortKey
        $vmInTx = $mirrorSession.SourcePortTRansmitted | where{$_.PortKey -contains $vmNic.Backing.Port.PortKey}
        if($Egress -and !$vmInTx){
            $mirrorSession.SourcePortTransmitted.PortKey += $vmNic.Backing.Port.PortKey
        $vspan.vspanSession = $mirrorSession
        $spec.vspanConfigSpec += $vspan
$spec.ConfigVersion = $dvSw.ExtensionData.Config.ConfigVersion
$dvSw.ExtensionData.ReconfigureDvs($spec)

Port mirroring with ALOT of Drops Tx on a 5406zl

Hi everybody.
My first post here and I'm convinced that the questions I have will be easily answered by several of the true experts that reside here in the forum.
Question #1.
I've set up port mirroring this way on my HP procurve J8697A Switch 5406zl (Software revision K.15.12.0015)
sw-dh-1(config)# show monitor 1
Network Monitoring
   Session: 4    Session Name:
      Mirror Destination: B13   (Port)
      Monitoring Sources Direction Truncation Mirror Policy
      Port: F1            Both       No         -
      Port: F2            Both       No         -
      Port: F3            Both       No         -
      sw-dh-1# show monitor 2
Network Monitoring
   Session: 3    Session Name:
      Mirror Destination: A6    (Port)
      Monitoring Sources Direction Truncation Mirror Policy
      Port: A7            Both       No         -
      Port: B6            Both       No         -
      Port: B10           Both       No         -
      Port: Trk5          Both       No         -
      Port: Trk9          Both       No         -
      Port: Trk11         Both       No         -
See output of "show interface" below. I'm worried about "Drop Tx". What does that mean exactly? Are mirrored packets dropped or does this mean that the ordinary traffic on the monitoring ports are also affected? If yes, how? Data loss, resending packets, loss of speed, high CPU load on the switch?
sw-dh-1# show interfaces B13
Status and Counters - Port Counters for port B13
Name : <removed>
MAC Address      : xxxxxx-xxxxx
Link Status      : Up
Totals (Since boot or last clear) :
   Bytes Rx        : 576                Bytes Tx        : 4,252,895,128
   Unicast Rx      : 0                  Unicast Tx      : 3,440,299,294
   Bcast/Mcast Rx : 9                  Bcast/Mcast Tx : 412,639,331
Errors (Since boot or last clear) :
   FCS Rx          : 0                  Drops Tx        : 29,441,235
   Alignment Rx    : 0                  Collisions Tx   : 0
   Runts Rx        : 0                  Late Colln Tx   : 0
   Giants Rx       : 0                  Excessive Colln : 0
   Total Rx Errors : 0                  Deferred Tx     : 0
Others (Since boot or last clear) :
   Discard Rx      : 0                  Out Queue Len   : 0
   Unknown Protos : 0
Rates (5 minute weighted average) :
   Total Rx (bps) : 0                  Total Tx (bps) : 5,002,088
   Unicast Rx (Pkts/sec) : 0            Unicast Tx (Pkts/sec) : 0
   B/Mcast Rx (Pkts/sec) : 0            B/Mcast Tx (Pkts/sec) : 6
   Utilization Rx :     0 %            Utilization Tx : 0.50 %
sw-dh-1# show interfaces A6
Status and Counters - Port Counters for port A6
Name : <removed>
MAC Address      : xxxxx-xxxxx
Link Status      : Up
Totals (Since boot or last clear) :
   Bytes Rx        : 960                Bytes Tx        : 1,442,037,177
   Unicast Rx      : 0                  Unicast Tx      : 1,988,961,810
   Bcast/Mcast Rx : 15                 Bcast/Mcast Tx : 339,915,002
Errors (Since boot or last clear) :
   FCS Rx          : 0                  Drops Tx        : 1,647,165,303
   Alignment Rx    : 0                  Collisions Tx   : 0
   Runts Rx        : 0                  Late Colln Tx   : 0
   Giants Rx       : 0                  Excessive Colln : 0
   Total Rx Errors : 0                  Deferred Tx     : 0
Others (Since boot or last clear) :
   Discard Rx      : 0                  Out Queue Len   : 0
   Unknown Protos : 0
Rates (5 minute weighted average) :
   Total Rx (bps) : 0                  Total Tx (bps) : 5,000,000
   Unicast Rx (Pkts/sec) : 0            Unicast Tx (Pkts/sec) : 0
   B/Mcast Rx (Pkts/sec) : 0            B/Mcast Tx (Pkts/sec) : 0
   Utilization Rx :     0 %            Utilization Tx : 0.50 %
Utilzation and total last 5 minutes is off since I turned the mirroring off when I saw the drops. Utilization when port mirroring was on was 20-35%.
Question #2:
Is it better if I mirror out all traffic to the 10GB port instead? Assuming that it is possible to do port mirroring to the 10GB port?
best regards,
Dean Y

You don;t indicate which router you have, but that doesn;t really matter.Neither the Actiontec MI424-WR or the Quantum G1100 have port mirroring.  You need qan old fashioned hub, or a managed switch that supports it.

SG300-28 Port Mirroring

Hello,
I am wondering if anyone else has issues with port mirrors? I have created a mirror to copy all packets from Interface gi1 to interface gi28. I don't see any port 80 traffic, or 443 or any revelant traffic. I see mostly broadcast from other devices. I have a security device that is logging all the copied packets from my firewall for malware/IPS, etc inspection.
Right now I have it monitoring vlan 1 in the hope that it would resolve this issue but I see no change. The config is attached for viewing.
Any thoughs?

Hi Alan, try to monitor a specific port instead of the whole VLAN.
-Tom
Please mark answered for helpful posts

Port mirroring in routers

Hi,
Port mirroring(SPAN) is possible in Switches, let me know if there is any sorts of feature implemented in Routers...
Cheers
Akhtar

Cisco has added a new feature that supports mirroring traffic on a router called IP traffic export. You need to run IOS version 12.3(4)T or later.
Check out the link below for configuration guidelines:
http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_chapter09186a0080455b94.html
HTH,
Sundar
*Please rate all helpful posts.

Port mirroring on SG300 questions

Hi all,
I'm troubleshooting a LAN issue I have, and I wanted to hook up wireshark to record traffic over the course of a couple of hours for later diagnostics. I went into the web administration interface, clicked Administration > Diagnostics > Port and VLAN Mirroring, and added a port mirror from the port I wanted to watch to a port to which I had connected a laptop. I picked the Tx and Rx options, and clicked Apply.
I did receive lots of traffic in wireshark, but I noticed immediately that the server on the port I had mirrored was suddenly unavailable on the network -- pings timed out. This lasted until I removed the mirror, then the server was suddenly reachable once again.
Does this feature not work the way I had thought it does? What I saw looked more like a forward than what I would call a mirror. The documentation leads me to believe mirroring is intended to be used in just the way I was attempting to use it.
Am I missing something?

Hi Lamint,
I have a SG300-10P for my test, I did the same thing you did in my GUI.
I was mirroring port 7 to port 8 ticking the item to mirror RX and TX
My PC with wireshark was residing on port 8.
I started a comtinuous oibg from my PC on port 7 at IP address 192.168.10.60 to my WAN routers LAN address, 192.168.10.1 .
As you can see from my screen capture below, my PC on port 8 caprtured both RX and TX packets on port 7.
Because my wireshark PC was on port 8, I could not access the management interface of the switch to show you my configuration, so I grabbed the configuration via hyperterminal.
See screen caopture below ( with some configuration items excluded)..
I would suggest, if you are having issues to allow the Small Business Support Center to assist you.
http://www.cisco.com/en/US/support/tsd_cisco_small_business_support_center_contacts.html
Hope this helps
regards Dave

Why does my sg 200 keeps changing port mirror destination to g1

On my sg 200-8 I have 1 port mirror session, with destination set to g4. If I disable, then enable, it changes the port to g1 and g4 is not among the ones I can choose. How do I re-enable it, without having to delete it and create a new one. And why does it keep changing it to g1?

Thanks Thomas. I think I was looking at it wrong regarding the SG switch saying that access mode ports do not tag traffic. It looks like it's from the viewpoint of how the ingress traffic looks. So, a port in access mode assumes that traffic coming in is untagged. Once that traffic ingresses into the port it is then tagged with the VLAN specified for that port. Does this sound right? It's just confusing how the SG switches describe the access mode ports as the PVID being untagged, when it actually is being tagged after data ingresses into the port.
By the way, the layer 3 device is an ASA 5510, which is also performing DHCP for the VLAN.
As you mentioned, I think my core issue is the upstream trunking configuration, which I'm looking into.
Thanks for your help,
Logan

Port mirroring on A90-9100EM15-10

Hey all -
I have the A90-9100EM15-10 FiOS router and I'd like to setup port mirroring from the router if it has the capability (I know, I know...this is typically done from a switch). Anyway, rather than purchase a managed switch or build a linux-based "switch" and place it inline, I'd be content with the ability to passively monitor traffic. I prefer to monitor traffic both directions but outgoing would suffice.
Does anyone know if my model FiOS router has such a capability?
Cheers,
Eneg

The 9100EM does not support port mirroring.
You might want to find a hub and use that to mirror the traffic.
http://shop.ebay.com/?_from=R40&_trksid=p5197.m570.l1313&_nkw=ethernet+hub&_sacat=See-All-Categories
Be careful though, many of those listed claim to be hubs are not and are in fact switches.

How to configure port mirroring in hyper-v

As the title ,anyone knows ?

Hi Jacky,
Hope following link is useful:
http://www.ms4u.info/2013/05/port-mirroring-on-windows-server-2012.htm
(In the source vm settings go to Network Adapter --> Advanced Features --> On Port Mirroring, set as Source mode. Do the same steps in the target VM and set as destination mode )
Best Regards
Elton Ji
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Port mirroring on SRW2048 kills Wireshark workstation IP

I have a workstation on this switch that is running WireShark and I need to get packets to it. However the moment I turn on port mirroring the station loses IP connectivity to the network. I tried Rx only, Tx only and both and all three settings knock the workstation off the IP network. Is there something I am missing? Also, I noticed that I can only mirror 4 source ports to this one target port. I would like to select pretty much all the ports as source port. Why can't I do this? I was previously using an older DLink switch that allowed me to mirror all ports and I am pretty sure that other switches like the Cisco 2900 series let you select all ports as source ports.
Thanks,
Diego

I fully understand what you are saying but that isn't consistent with previous experiences with port mirroring. I have used Cisco Catalyst type switches and also DLink switches that allow you to mirror all ports on the switch to one destination port. And even with all ports mirrored IP connectivity to the destination port is maintained.
This is not so surprising on the Catalyst stuff which is considered maybe a bit more "high end" than Linksys but the DLink which is a cheaper switch has the ability to do this just as the Catalyst. It seems that the Linksys is inferior in this regard to the Catalyst and the DLink.
Sorry to hear that and hopefully a future firmware version will change this behavior.
Thank you very much for your help.
Rgds,
Diego

Catalyst Express 500 port mirroring capabilities

Does it have this switch some port mirroring capability (SPAN or other)?

See...
http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml#Cat500

Managing vDS Port Mirroring Sessions

When using vDS port mirroring, you can only select groups of Vms by ports, not by other groupings such as virtual machine folders, clusters, hosts, etc. This means that although you can set up a port mirroring session to take a set of existing VMs and mirror their traffic to a collector, vCenter doesn't automatically add new VMs in the same folder as those existing VMs to the session. YOu can specify a range of vDS ports to mirror, but you don't know what port numbers will be assigned new VMs when they are created. If you want to mirror all VMs for a group of VMs belonging to one department or one customer, and have all new VMs belonging to that department or customer added to the mirroring session, what is the best way to do this?

Does this mean that mirrored traffic will leave the ESXi management vmkernel port?
That appears to be the case, and is the only way that makes sense to me. I mean you need some independent existing IP stack to transport the encapsulated traffic.
This is also suggested by this article:
http://www.routereflector.com/2014/07/port-mirroring-on-vmware-vswitchdvswitch-dvmirror/

Port mirroring

Similar Messages

Maybe you are looking for