The ability to mirror a port is a very crucial part of troubleshooting especially when you need to see traffic that is ingressing and egressing from a specific port that a host is connected to. The best way to see that traffic is to setup a port mirror on that port. A port mirror can be described basically as a window into the traffic on a particular port. A couple of things to keep in mind when you setup a port mirror:
- The traffic to and from the workstation or laptop you are using to “sniff” the traffic on the port mirror is basically disconnected as its entire purpose in life is now to simply see the traffic coming in and out of the port you are monitoring. So you won’t be able to do any “remote” port mirror operations 🙂
- Also, you don’t have to worry about IP addressing on the workstation/laptop you are sniffing with as it doesn’t need an address to see the traffic
Most switches have a means to enable port mirroring either in a web interface or commandline and usually both. With the Nseries, the easiest way is to use the web interface to flag on port mirroring.
In the example, we are using an N2048 switch to demonstrate the mirror.
- Navigate to the Switching >> Ports >> Traffic Mirroring >> Port Mirroring menu in the web interface.
Notice below that the Admin Mode is set to Disable. This means that the port mirroring functionality is not turned on. And obviously we don’t have a destination setup or source port(s) defined.
Below we have added a destination port which is the port that the monitoring workstation will be plugged into. This would be the port you would plug into with a workstation or laptop for instance running wireshark.
To add a source port for the port mirror, simply click the Add button at the top of the Port Mirroring window and you will see the Port Mirroring: Add box to select your source port.
After you have defined the source port(s) for monitoring, simply flag the Admin Mode to Enable
At this point you should have successfully setup a port mirror from a source port(s) over to a destination port for a monitoring workstation to be able to see traffic.