What is Port Mirroring?
Port mirroring, also known as port monitoring or network tapping, is a feature in network switches that allows the network administrator to copy and send network traffic from one port (or group of ports) to another port for monitoring and analysis purposes. This feature is commonly used for network troubleshooting, performance monitoring, security analysis, and compliance auditing.
Enable Telnet Client on Windows 10
The following link shows how to enable Telnet Client on Windows 10:
Accessing the MXNet Switch via Windows Telnet Client
1. Once Telnet is enabled, you can access it by typing "telnet" into your Windows search bar, then selecting it.
2. This will open a new terminal window for Telnet communication.
3. Type in the letter "o" to open the remote server, followed by entering in the IP address of the switch.
4. Type in "admin" for both the login and password.
MXNet Switch CLI Commands to Set Up Port Mirroring
First, you will need to identify the source port or group of ports that you want to monitor. In this example, we will monitor the traffic on interface ethernet 1/0/1;3;5;7;9;11
CLI: monitor session 1 source interface ethernet 1/0/1;3;5;7;9;11
Next you will need to configure the destination port where the monitored traffic will be sent. In this example, we will use interface ethernet 1/0/43 as the destination port:
CLI: monitor session 1 destination interface ethernet 1/0/43
(For more information on how to configure specific ports, see this KB article, Step 2 of the Basic Configurations for the Switch section.)
Command: Monitor Session Source Interface
monitor
session <session>source{interface <interface-list>}{rx| tx| both}
|
Format
|
monitor
|
session
|
<session number>
|
source
|
interface-list
|
rx| tx| both
|
|
Command
|
monitor
|
session
|
1
|
source
|
interface ethernet
1/0/1;3;5;7;9;11
|
both
|
|
Description
|
|
|
|
|
Source Port – Select
the source port of the traffic to be mirrored.
The above commands show
source ports include:
1/0/1, 1/0/3, 1/0/5,
1/0/7, 1/0/9, 1/0/11
|
Type – Select whether
incoming, outgoing, or both types of traffic are mirrored to the destination
port.
•
rx
– port mirroring on incoming packets
•
tx
– port mirroring on outgoing packets
•
both
– port mirroring on both incoming and outgoing packets
|
|
Command examples:
Switch(config)#monitor session 1 source interface ethernet 1/0/1-4 tx
Switch(config)#monitor session 1 source interface ethernet 1/0/5 rx
Command: Monitor Session Destination Interface
monitor
session<session>destination interface<interface-number>
|
Format
|
monitor
|
session
|
<session number>
|
destination
|
interface-list
|
Command
|
monitor
|
session
|
1
|
destination
|
interface ethernet
1/0/43
|
Description
|
|
|
|
|
Destination Port –
Select the analyzer port where packets are to be copied. A network analyzer,
such as a computer running Wireshark, should be connected to this port. If a
port is identified as an analyzer destination port, it remains the analyzer
destination port until all entries are removed.
|
Command example:
Switch(config)#monitor session 1 destination interface ethernet 1/0/7
You can enter in the command show running-config to check the configuration.
Command: Delete One of the Source Ports
Delete interface 1/0/3 from the source port list
Switch(config)#no monitor session 1 source interface ethernet 1/0/3
Monitoring from Network Analyzer (such as Wireshark)