Administrator Guide

Layer 2 Switching Commands 660
Port Monitor Commands
Dell Networking N1500/N2000/N3000/N4000 Series Switches
Dell Networking switches allow the user to monitor traffic with an external
network analyzer. The external network analyzer can use any of the Ethernet
ports as a probe port. The probe port transmits a mirror copy of the traffic
being probed. Network traffic transmission is always disrupted whenever a
configuration change is made for port monitoring. Therefore, whenever port
monitoring is enabled, the probe port does not always forward traffic as a
normal port. When diagnosing problems, an operator should always check the
status of port monitoring.
The port monitoring feature allows the user to configure a single probe
session. A session consists of one destination or probe port and one or
multiple source ports. When a session is enabled, any traffic entering or
leaving the source ports of that session is copied (mirrored) onto the
corresponding destination port. A network traffic analyzer can be attached to
destination ports to analyze the traffic patterns of source ports.
A session is operationally active only if both a destination port and at least
one source port are configured. If neither is true, the session is inactive. A port
configured as a destination port acts as a mirroring port when the session is
operationally active. If it is not, the port acts as a normal port and participates
in all normal operation with respect to transmitting traffic.
The port mirroring logic stage occurs after the after the VLAN tag processing
stage on ingress and before the VLAN tag processing stage on egress. When
mirroring packets associated with DVLAN/QinQ SP or CE ports, the outer
VLAN tag may or may not appear in the frame. Due to the internal processing
of QinQ tagging, the TPID of ingress frames mirrored from the SP port will
always be 0x8100. In addition, packets forwarded internally across a stacking
link may have different tags applied than packets forwarded on a local egress
port. This is due to the processing required for forwarding across a stack.
Any Ethernet port may be configured as a source port.
Caveats:
• Platforms may behave unpredictably if an attempt is made to mirror a port
of greater speed than the probe port.
2CSNXXX_SWUM204.book Page 660 Monday, January 25, 2016 1:25 PM