TMS zl Management and Configuration Guide ST.1.0.090213

3-5
Initial Setup in Monitor Mode
Overview
In Figure 3-2, a ProVision ASIC switch capable of remote mirroring also
mirrors traffic to the TMS zl Module. When the switch receives traffic that has
been selected for mirroring (whether by its port or VLAN), it both forwards
the traffic toward its destination and sends a copy of the traffic in a mirror
session to the module’s host switch. The mirror session might extend across
several switches (whether or not those switches or capable of remote mirror-
ing) but not across a Layer 3 boundary. That is, the host switch and the remote
switch must establish the mirror session on the same VLAN. However, the
remote switch can include traffic from other VLANs within the session. When
the host switch receives the remotely mirrored traffic, it forwards on the
module’s data port, and the module’s IDS analyzes the traffic just as it would
locally mirrored traffic.