Chapter 30. Port Mirroring - IBM RackSwitch G8000 Application Manual

Chapter 30. Port Mirroring

© Copyright IBM Corp. 2011
The IBM Networking OS port mirroring feature allows you to mirror (copy) the
packets of a target port, and forward them to a monitoring port. Port mirroring
functions for all layer 2 and layer 3 traffic on a port. This feature can be used as a
troubleshooting tool or to enhance the security of your network. For example, an
IDS server or other traffic sniffer device or analyzer can be connected to the
monitoring port to detect intruders attacking the network.
The G8000 supports a "many to one" mirroring model. As shown in
selected traffic for ports 1 and 2 is being monitored by port 3. In the example, both
ingress traffic and egress traffic on port 2 are copied and forwarded to the monitor.
However, port 1 mirroring is configured so that only ingress traffic is copied and
forwarded to the monitor. A device attached to port 3 can analyze the resulting
mirrored traffic.
Figure 41. Mirroring Ports
Mirrored Ports Monitor Port
Ingress Connected to
Both
Traffic sniffer device
1 2 3 4
Specified traffic is copied
and forwarded to Monitor Port
The G8000 supports three monitor ports in stand-alone (non-stacking) mode. Only
one monitor port is supported in stacking mode. Each monitor port can receive
mirrored traffic from any number of target ports.
IBM N/OS does not support "one to many" or "many to many" mirroring models
where traffic from a specific port traffic is copied to multiple monitor ports. For
example, port 1 traffic cannot be monitored by both port 3 and 4 at the same time,
nor can port 2 ingress traffic be monitored by a different port than its egress traffic.
Ingress and egress traffic is duplicated and sent to the monitor port after processing.
Configuring Port Mirroring
The following procedure may be used to configure port mirroring for the example
shown in Figure 41 on page
1. Specify the monitoring port, the mirroring port(s), and the port-mirror direction.
RS G8000(config)# port-mirroring monitor-port 3 mirroring-port 1 in
RS G8000(config)# port-mirroring monitor-port 3 mirroring-port 2 both
2. Enable port mirroring.
RS G8000(config)# port-mirroring enable
341:
Figure 41,
341