© Copyright IBM Corp. 2011 341
Chapter 30. Port Mirroring
The IBM Networking OS port mirroring feature allows you to mirror (copy) the
packets of a target port, and forward them to a monitoring port. Port mirroring
functions for all layer 2 and layer 3 traffic on a port. This feature can be used as a
troubleshooting tool or to enhance the security of your network. For example, an
IDS server or other traffic sniffer device or analyzer can be connected to the
monitoring port to detect intruders attacking the network.
The G8000 supports a “many to one” mirroring model. As shown in Figure 41,
selected traffic for ports 1 and 2 is being monitored by port 3. In the example, both
ingress traffic and egress traffic on port 2 are copied and forwarded to the monitor.
However, port 1 mirroring is configured so that only ingress traffic is copied and
forwarded to the monitor. A device attached to port 3 can analyze the resulting
mirrored traffic.
Figure 41. Mirroring Ports
The G8000 supports three monitor ports in stand-alone (non-stacking) mode. Only
one monitor port is supported in stacking mode. Each monitor port can receive
mirrored traffic from any number of target ports.
IBM N/OS does not support “one to many” or “many to many” mirroring models
where traffic from a specific port traffic is copied to multiple monitor ports. For
example, port 1 traffic cannot be monitored by both port 3 and 4 at the same time,
nor can port 2 ingress traffic be monitored by a different port than its egress traffic.
Ingress and egress traffic is duplicated and sent to the monitor port after processing.
Configuring Port Mirroring
The following procedure may be used to configure port mirroring for the example
shown in Figure 41 on page 341:
1. Specify the monitoring port, the mirroring port(s), and the port-mirror direction.
2. Enable port mirroring.
Monitor Port
Specified traffic is copied
and forwarded to Monitor Port
Mirrored Ports
Ingress
Traffic
Both
Connected to
sniffer device
1 2
3
4
RS G8000(config)# port-mirroring monitor-port 3 mirroring-port 1 in
RS G8000(config)# port-mirroring monitor-port 3 mirroring-port 2 both
RS G8000(config)# port-mirroring enable
To Next Page
Loading...
Need help?
General
