Port Mirroring

Port Mirror is done when you would like to investigate traffic.
By enabling port mirror, you are sending a copy of a port traffic to
another port. Some switches can be done via the GUI and most of them
can be done via command-line. Here is some tips on configuring Port Mirror:

  1. Define the port which should receive the traffic:
    mirror-port 1/1/24
  2. Then configure the port which will be mirrored from:
    interface 1/1/12 monitor
  3. Should you require a VLAN to be monitored, you can:
    vlan 1 monitor
  4. Should you wish to mirror a range of ports:
    mirror-port range <1 – 5>
  5. When you complete your troubleshooting, you can switch off the port mirror:
    no mirror-port
  6. Once you completed, you can run the following to check if the port mirror configuration is correct: Show monitor
  7. Then, depending on the switch type, you may have multiple sessions. Select the session you want to confirm: Show monitor 1

Then you can have the port connected to a physical or virtual machine. You can use Wireshark or fiddler (personal recommendation) to monitor the traffic. Start the monitor, allow few minutes, stop the monitor and then save a PCAP file. Then open in Wireshark or fiddler. This method is also used in troubleshooting Exchange connectivity, setup issues and even intermittent issues.

Be the first to comment

Leave a Reply

Your email address will not be published.


*


This site uses Akismet to reduce spam. Learn how your comment data is processed.