Port Monitoring; Important Points To Remember - Dell Z9000 Configuration Manual

Port Monitoring

Port monitoring is supported on the Z9000 platform.
Mirroring is used for monitoring Ingress or Egress or both Ingress and Egress traffic on a specific port(s).
This mirrored traffic can be sent to a port where a network sniffer can connect and monitor the traffic.
Dell Networking OS supports the following mirroring techniques:
• Port-Mirroring — Port Monitoring is a method of monitoring network traffic that forwards a copy of
each incoming and outgoing packet from one port of a network router to another port where the
packet can be studied.
• Remote Port Monitoring (RPM) — Remote Port Monitoring allows the user to monitor traffic running
across a remote device in the same network. Here the mirror traffic is carried over the L2 network, so
that probe devices in the network can analyze it. It is an extension to the normal Port Monitoring
feature. This feature is generally referred as RPM, where mirror traffic is carried over L2 network.
• Encapsulated Remote-Port Monitoring (ERPM) — ERPM is a feature to encapsulate mirrored packet
using GRE with IP delivery so that it can be sent across a routed network.

Important Points to Remember

• Port Monitoring is supported on both physical and logical interfaces like virtual area network (VLAN)
and port-channel.
• The monitored (the source, [MD]) and monitoring ports (the destination, [MG]) must be on the same
switch.
• In general, a monitoring port should have no ip address and no shutdown as the only configuration;
Dell Networking OS permits a limited set of commands for monitoring ports. You can display these
commands using the ? command. A monitoring port also may not be a member of a VLAN.
• There may only be one destination port (MG) in a monitoring session.
• Source port (MD) can be monitored by more than one destination port (MG).
• Destination port (MG) can be a physical interface or port-channel interface.
• A Port monitoring session can have multiple source statements.
• Range command is supported in the source statement, where we can specify a range of interfaces of
(Physical, Port Channel or VLAN) types.
• One Destination Port (MG) can be used in multiple sessions.
• There can be a maximum of 128 source ports in a Port Monitoring session.
• Flow based monitoring is supported for all type of source interfaces.
• Source port (MD) can be a VLAN, where the VLAN traffic received on that port pipe where its
members are present is monitored
• Single MD can be monitored on max. of 4 MG ports. If you try to assign a monitored port to more
than one monitoring port, the following message displays:
Dell (conf-mon-sess-2)#do show monitor session
SessID Source
------ ------
1 Te 0/0
Port Monitoring
Destination
-----------
Te 0/1
Dir Mode Source IP
--- ---- ---------
both Port N/A
34
Dest IP
--------
N/A
609