Administrator Guide

526 Monitoring Switch Traffic
• On ingress, the port mirroring logic stage is after the VLAN tag processing
stage in the hardware. This means that mirrored packets may not appear
the same as they do on the wire if VLAN tag processing occurs. Examples
of VLAN tag processing are DVLAN tunneling (QinQ) or VLAN rewriting.
Likewise, on egress, the port mirroring logic stage is before the VLAN tag
processing stage. This means that on egress, packets may not appear as
they do on the wire if processing such as VLAN or CoS value rewriting is
programmed.
Remote Capture
The Remote Capture feature enables mirroring packets transmitted and
received by the switch CPU to a remote client for packet analysis using the
Wireshark tool. This feature can be used to help diagnose switch behavior or
monitor traffic sent to the switch CPU. The capture feature can also be
configured to capture to a local file or to an in-memory buffer.
Why is Traffic Monitoring Needed?
Monitoring the traffic that the switch handles, as well as monitoring all traffic
in the network, can help provide information about network performance and
utilization. This information can be useful in network planning and resource
allocation. Information about traffic flows can also help troubleshoot
problems in the network.
Default Traffic Monitoring Values
The sFlow agent is enabled by default, but sampling and polling are disabled
on all ports. Additionally, no sFlow receivers (collectors) are configured.
Table 16-1 contains additional default values for the sFlow feature.
Table 16-1. sFlow Defaults
Parameter Default Value
Receiver timeout for sampling 0
Receiver port 6343
Receiver Maximum Datagram Size 1400 bytes
Maximum header size 128 bytes