What is port mirroring and how do I use it for troubleshooting?

Port mirroring (also called SPAN — Switched Port ANalyzer) copies traffic from one or more source ports to a designated destination port for monitoring.

Use Cases

• Traffic analysis and troubleshooting
• Network intrusion detection (IDS/IPS)
• Compliance monitoring
• Application performance analysis
• Baseline traffic profiling

Mirror Types

• Local SPAN: Source and destination on same switch
• RSPAN (Remote SPAN): Traffic sent across VLAN to remote destination
• ERSPAN (Encapsulated RSPAN): Encapsulated in GRE for L3 destinations

Direction Options

• Ingress: Traffic received by source port
• Egress: Traffic sent from source port
• Both: Full bidirectional visibility

Configuration Example

monitor session 1 source interface Gi0/5 both\nmonitor session 1 destination interface Gi0/24

Common Tools to Connect

• Wireshark on laptop
• Dedicated packet capture appliance
• IDS: Snort, Suricata
• Flow analyzer: ntopng

Limitations

• Destination port usually cannot forward normal traffic
• Aggregated traffic may exceed destination port speed
• Some CPU-generated packets not mirrored
• May impact switch performance if oversubscribed

Best Practices

1. Mirror to a port with equal or higher speed than sum of sources
2. Use a dedicated capture NIC (Gigabit min for busy links)
3. Filter at capture side to avoid overwhelming disk
4. Disable when not needed