HP ProCurve Management And Configuration Manual page 581

Effect of IGMP on Mirroring: If both inbound and outbound mirroring
■
is operating when IGMP is enabled on any VLAN, two copies of mirrored
IGMP frames may appear at the mirroring destination.
■ Mirrored Traffic Not Encrypted: Mirrored traffic undergoes IPv4
encapsulation, but mirrored, encapsulated traffic is not encrypted.
IPv4 Header Added: The IPv4 encapsulation of mirrored traffic adds a
■
54-byte header to each mirrored frame. If a resulting frame exceeds the
maximum MTU allowed in the network, it will be dropped. To reduce the
number of dropped frames, enable jumbo frames in the mirroring path,
including all intermediate switches and/or routers. (The maximum trans­
mission unit—MTU—on the switch is 9220 bytes, which includes 4 bytes
for the 802.1Q VLAN tag.) For more information, refer to "Maximum
Supported Frame Size" on page B-68. To configure the switch for jumbo
frames, refer to "Configuring Jumbo Frame Operation" on page 13-28.
■ Intercepted or Injected Traffic: The mirroring feature does not protect
against either mirrored traffic being intercepted or traffic being injected
into a mirrored stream by an intermediate host.
Inbound IPv4-Encapsulated Frames Not Mirrored: The switch does
■
not mirror IPv4-encapsulated frames it receives on an interface. This
prevents duplicate mirrored frames in configurations where the port
connecting the switch to the network path for mirroring to a destination
is also a port whose inbound or outbound traffic is being mirrored. For
example, if traffic leaving the switch through ports B5, B6, and B7 is being
mirrored through port B7 to a network analyzer, the mirrored frames from
traffic on ports B5 and B6 will not be mirrored a second time as they pass
through port B7.
Switch Operation as Both Destination and Source: A switch config­
■
ured as remote destination switch can also be configured to mirror traffic
to one of its own ports (local mirroring) or to a destination on another
switch (remote mirroring).
■ Monitor Command Note: If session 1 is already configured with a
destination, you can execute [no] vlan < vid > monitor or [no] interface
< port > monitor without mirroring criteria and a mirror session number. In
this case, the switch automatically configures or removes mirroring for
inbound and outbound traffic from the specified VLAN or port(s) to the
destination configured for session 1.
Loss of Connectivity Suspends Remote Mirroring: When a remote
■
mirroring session is configured on a source switch, the switch sends an
ARP request to the configured destination approximately every 60 sec­
onds. If the source switch fails to receive the expected ARP response from
the destination for that session, transmission of mirrored traffic for the
session halts. However, because the source switch continues to send ARP
Monitoring and Analyzing Switch Operation
Traffic Mirroring
B-71