Users Guide

568 Monitoring Switch Traffic
in spanning tree, IGMP/MLD snooping, or GVRP; do not learn MAC
addresses (learned MAC addresses are purged); do not participate in routing
(route entries are purged); and do not utilize any static filter configuration.
Incoming packets are dropped. Probe ports “lose” their VLAN membership,
i.e. they do not forward/flood packets based on VLAN membership. Changing
VLAN membership does not affect a probe port until the port is removed
from probe status. Traffic transmitted into a probe port from the connected
station is dropped. The original configuration of a destination port is restored
when the port is no longer configured as a destination port. A probe port
should be connected to a network analyzer or intrusion detection system and
should never be connected to a network as control plane traffic from the
mirrored sources is transmitted to the probe.
On ingress, the port mirroring logic stage is after the VLAN tag processing
stage in the hardware. This means that mirrored packets may not appear the
same as they do on the wire if VLAN tag processing occurs. Examples of
VLAN tag processing are DVLAN tunneling (QinQ) or VLAN rewriting.
Likewise, on egress, the port mirroring logic stage is before the VLAN tag
processing stage. This means that, on egress, packets may not appear as they
do on the wire if processing such as VLAN or CoS value rewriting is
programmed.
Each source port can be configured whether to mirror ingress traffic (traffic
the port receives, or RX), egress traffic (traffic the port sends, or TX), or both
ingress and egress traffic.
An ACL can be configured to filter traffic and attached to a port-mirroring
session. This is often useful to reduce the amount of traffic transmitted to the
probe port. The ACL filter is configured on the source switch. An ACL filter
is internally re-configured as an egress ACL on the destination
interface/reflector port. All criteria in the ACL are marked with the mirror
attribute (and the RSPAN VLAN) to match the mirrored traffic (including
the implicit deny-all). If configuring an egress ACL on the destination port,
care must be taken with the ACL numbering to ensure the mirrored traffic is
properly processed.
NOTE: A DiffServ policy class definition or an ACL can be created that mirrors
specific types of traffic to a destination port. For more information, see
"Differentiated Services" on page 1487 or "Access Control Lists" on page 671.