Dell SmartFabric OS10 User Guide Release 10.5.3

Port monitoring

Port monitoring is an application that mirrors the ingress or egress traffic of one port to another for analysis.

A monitoring port, or destination port, is the port where the monitored traffic is sent for analysis. A monitored port, or source port, is the source interface that is monitored for traffic analysis.

The different types of port monitoring are:

• Local port monitoring—Port monitoring is done in the same switch. The switch forwards a copy of incoming and outgoing traffic from one port to another port for further analysis.
• Remote port monitoring (RPM)—Port monitoring is done on traffic running across a remote device in the same network. The L2 network carries the monitored traffic.
• Encapsulated remote port monitoring (ERPM)—Port monitoring is done on the L3 network. The traffic from the source port is encapsulated and forwarded to the destination port in another switch.

Configuration notes

All Dell PowerSwitches except S4200-Series, S5200 Series, and Z9332F-ON:

• When you configure a port as a source interface, and add the same port to the remote VLAN used for monitoring traffic, the configuration fails and the system does not display an error message. Dell Technologies recommends adding the ports to the destination remote VLAN first and then configuring the source interface. In this case, when you configure the destination port as source, the system displays an error message.
• When you configure remote port mirroring and overwrite the transport VLAN by re-entering the destination remotevlan vlan-id command with a different VLAN ID, an error message displays. The new remote VLAN configuration is not accepted. You must first remove the configured remote VLAN using the no version of the command, and then re-enter the command with the new remote VLAN ID.
• VLAN statistics on the remote port mirroring (RPM) VLAN interface are not incremented on the following switches: S4048-ON, S4048T-ON, S4100-ON, S6010-ON, and Z9264F-ON. For these switches, the show interface vlan rpm_vlanid command does not display statistics for the mirrored traffic.

Supported mirroring sessions:

• You can configure two monitoring sessions if the monitoring involves both directions.
• You can configure four monitoring sessions if the monitoring involves either ingress or egress direction. In such case, you can configure a total of four unique destination ports.
• The maximum supported source ports per mirroring session is 108.
• You can configure one destination port per mirroring session.
• There is no bandwidth limit for mirroring.
• If SmartFabric OS10 generates packets as a response to ARP or ICMP requests; such as ARP responses or ICMP reply packets, the port monitoring sessions do not mirror these packets. To be able to capture these packets, SmartFabric OS10 recommends to use the tcpdump -i any command on the root prompt of the SmartFabric OS10 switch.