Traffic Mirroring Types; Restrictions - Cisco NCS 5500 Series Configuration Manual

Traffic Mirroring Types

Traffic mirroring copies traffic from one or more source ports and sends the copied traffic to one or more
destinations for analysis by a network analyzer or other monitoring device. Traffic mirroring does not affect
the flow of traffic on the source interfaces or sub-interfaces, and allows the mirrored traffic to be sent to a
destination interface or sub-interface.
For example, you need to attach a traffic analyzer to the router if you want to capture Ethernet traffic that is
sent by host A to host B. All other ports see the traffic between hosts A and B.
Figure 9: Traffic Mirroring Operation
When local traffic mirroring is enabled, the traffic analyzer is attached directly to the port that is configured
to receive a copy of every packet that host A sends. This port is called a traffic mirroring port. The other
sections of this document describe how you can fine tune this feature.

Traffic Mirroring Types

These traffic mirroring types are supported:
• Local traffic mirroring: This is the most basic form of traffic mirroring. The network analyzer or sniffer
• Remote traffic mirroring: The network analyzer is reached through a GRE tunnel over an IP network.
A copy of every packet includes the Layer 2 header, if the ethernet keyword is configured. As this renders
Note
the mirrored packets un-routable, the end of the GRE tunnel must be the network analyzer.

Restrictions

The following are the ERSPAN and SPAN ACL restrictions:
• SPAN counters are not supported.
• SPAN only supports port-level source interface.
• The value of ERSPAN session-ID is always zero.
Interface and Hardware Component Configuration Guide for Cisco NCS 5500 Series Routers, IOS XR Release
6.1.x
124
is directly attached to the destination interface. In other words, all monitored ports are all located on the
same router as the destination port.
• All of the sub-interface traffic is included.
Configuring Traffic Mirroring