Administrator Guide

Monitoring Switch Traffic 523
The RMON agent in the switch supports the following groups:
• Group 1—Statistics. Contains cumulative traffic and error statistics.
• Group 2—History. Generates reports from periodic traffic sampling that
are useful for analyzing trends.
• Group 3 —Alarm. Enables the definition and setting of thresholds for
various counters. Thresholds can be passed in either a rising or falling
direction on existing MIB objects, primarily those in the Statistics group.
An alarm is triggered when a threshold is crossed and the alarm is passed to
the Event group. The Alarm requires the Event Group.
• Group 9 —Event. Controls the actions that are taken when an event
occurs. RMON events occur when:
– A threshold (alarm) is exceeded
– There is a match on certain filters.
What is Port Mirroring?
Port mirroring is used to monitor the network traffic that a port sends and
receives. The Port Mirroring feature creates a copy of the traffic that the
source port handles and sends it to a destination port. The source port is the
port that is being monitored. The destination port is where a network
protocol analyzer (probe) is connected. Dell Networking N-Series switches
also support RSPAN destinations where traffic can be tunneled across the
operational network over dedicated links.
A port monitoring session includes one or more source ports that mirror
traffic to a single destination port (also known as a probe port). Sources can
include VLANs, physical interfaces, port-channels, the internal CPU port,
and IP or MAC ACL flows. Certain sources are not supported; i.e., physical
members of a port-channel, VLANs that contain a LAG member, etc. Up to
four monitoring sessions, each with a unique destination port, may be
configured. Destination ports, once configured, no longer participate in
spanning tree, IGMP/MLD snooping, or GVRP; do not learn MAC addresses
(learned MAC addresses are purged); do not participate in routing (route
NOTE: The switch supports RMON1.