Port Mirroring Question 1

[nhidalgo]

I have two application that need to watch traffic comming off of our POS server using a mirror port of the server port. My Dlink switch only allows you to select one destination port as the mirror port. Being that i need two ports, i then have a 10/100 hub plugged into this mirror port to fead the two other systems. We seem to be having periodic problems with this setup. The server is connected at 100MB full to the switch, the hub it connected at 100MB HALf. Is it possible that we are sending data to the mirror port faster than the hub can accept it and causing RX errors? Is there a cisco switch that allows you to mirror one port to two destination ports? Any comments would be great.
Thanks
Nick

 

[Belushi]

Yes, you can but it most likely depends on the type of Cisco switch you are using. For instance, my lab 3550s (EMI image) will not allow more than one destination interface, however my lab 3560s (EMI image as well) does indeed allow it. Here is the proof:

SW4#sh monitor session all
Session 1
---------
Type : Local Session
Source Ports :
Both : Fa0/10
Destination Ports : Fa0/11-12
Encapsulation : Native
Ingress : Disabled

I would go to CCO and chck out the datasheets of the various switches. It should tell you what you need yo know. Otherwise, open up an information based TAC case and they should be able to tell you the answer. Don't tell too many people I said that though because there wouldn't be much need for this website if everyone did that!!!

 

[nhidalgo]

thank you very much for the info.

 

[baddos]

The hub should be fine provided the 2 hosts you are mirroring to aren't trying to use their nics for anything else. Make sure those nics have all protocols unbound for them.