TMS zl Management and Configuration Guide ST.1.2.100916

3-5
Initial Setup in Monitor Mode
Overview
Figure 3-1. Logical Remote Mirroring Operation of
the TMS zl Module in Monitor Mode
When a 5400zl or 8200zl switch receives traffic that has been selected for
mirroring (whether by its port or VLAN), it both forwards the traffic toward
its destination and sends a copy of the traffic in a mirror session to the
module’s host switch. The mirror session might extend across several
switches (whether or not those switches or capable of remote mirroring), but
not across a Layer 3 boundary. That is, the host switch and the remote switch
must establish the mirror session on the same VLAN. However, the remote
switch can include traffic from other VLANs within the session. When the host
switch receives the remotely mirrored traffic, it forwards this traffic to the
module’s data port, and the module’s IDS analyzes the traffic just as it would
locally mirrored traffic.