Enterasys Networks ENTERASYS ATX - Manual (Page 67)

6-1
Chapter 6
ATX Port Mirroring
Using Port MIrroring; configuring port mirroring locally; configuring port mirroring remotely
The Port Mirroring utility allows you to capture network traffic appearing on one
or more of the ATX’s ports, and to reproduce that traffic on a designated
“diagnostic” port for monitoring purposes. The diagnostic port may be another of
the ATX’s ports (Ethernet, Token Ring, or FDDI), or a remote port on another ATX
in your network.
The Port Mirroring window ( Figure 6-1 ) allows you to define port mirrors and
specify a diagnostic port. If mirrored packets are to be sent to a remote diagnostic
port, this window is also used to configure the remote ATX to direct mirrored
packets to the desired diagnostic port in its domain.
Port mirroring introduces a certain amount of latency to the switch’s traffic,
depending upon the load at the mirrored ports, the types of packets being
captured, and whether the diagnostic port is local or remote. To remedy this
situation, you can establish “mirror filters” using the ATX’s Port Filtering utility.
Mirror filters are especially helpful when you are using a remote diagnostic port,
since the physical connection to the remote port imposes bandwidth constraints
on the mirrored traffic. Using a mirror filter you can restrict the amount of
monitored traffic by filtering inbound or outbound packets according to source
and destination addresses, vendors, types, and frame protocols. You can also filter
out packets based on a designated portion of their data field. Mirror filters can
also be used when you are using a local diagnostic port, if necessary. See
Chapter 4, Using ATX Port Filtering, for details on defining mirror filters.
The Port mirroring window also allows you to discard or truncate oversized
packets when using a local diagnostic port.
NOTE
When mirroring traffic to a remote diagnostic port, the mirrored packets are encapsulated
and routed to the specified port. Oversized packets are segmented during this process, and
therefore do not need to be discarded or truncated.