Reference Guide

Port Monitoring
Port monitoring (also referred to as mirroring) allows you to monitor ingress and/or egress traffic on specified ports. The
mirrored traffic can be sent to a port to which a network analyzer is connected to inspect or troubleshoot the traffic.
The Dell Networking OS supports the following mirroring techniques:
● Port monitoring — Monitors network traffic by forwarding a copy of incoming and outgoing packets from a source port to a
destination port on the same network router.
● Remote port monitoring (RPM) — Monitors traffic on a remote device in the network. Mirrored traffic is sent over the L2
network to a destination port, where a probe device can analyze it. RPM is an extension of the port monitoring feature.
● Encapsulated remote-port monitoring (ERPM) — Encapsulates mirrored packet using GRE tunneling over an IP routed
network.
Topics:
• Local Port Monitoring
• Remote Port Mirroring
• Encapsulated Remote-Port Monitoring
Local Port Monitoring
Port monitoring is supported on both physical and logical interfaces, such as VLAN and port-channel interfaces. The source port
(MD) with monitored traffic and the destination ports (MG) to which an analyzer can be attached must be on the same switch.
You can configure up to 128 source ports in a monitoring session. Only one destination port is supported in a monitoring session.
Important Points to Remember
● A source port should have only no ip address and no shutdown as its configured settings. A source port cannot be a
member of a VLAN.
● The range command is supported in the source command to specify multiple source ports.
● You can enter multiple source statements in a monitoring session. A source port can be monitored by more than one
destination port.
● A destination port can be a physical or port-channel interface, and can be used in multiple sessions.
● A maximum number of four destination ports is supported per port pipe. For information about port pipes on the switch, see
Port-pipes.
● Flow-based monitoring is supported on all types of source interfaces.
Examples of Port Monitoring
In the following examples of port monitoring, the four source ports 0/13, 0/14, 0/15, and 0/16 belong to the same port pipe and
mirror traffic to four different destinations (0/1, 0/2, 0/3, and 0/37).
You cannot add another destination on the same port pipe in a monitoring session because a maximum number of four
destination ports are supported on the same port pipe. If you configure another destination port on the same port pipe, a Syslog
message is generated: Unable to create MTP entry for MD interface MG interface in stack-unit
stack-num port-pipe port-num.
Example of Changing the Destination Port in a Monitoring Session
Dell(conf-mon-sess-5)#do show moni session
SessID Source Destination Dir Mode Source IP Dest IP
------ ------ ----------- --- ---- --------- --------
1 Te 0/0 Te 0/1 both Port N/A N/A
40
574 Port Monitoring