On this page
What a mirror port does, and the three directionsOversubscription: mirroring 10G to 1GRemote mirroringTAP versus mirror portProcedure: configure, capture, verify, removeVerifying with a packet capturePrivacy and legal noteQuestions01 /What a mirror port does, and the three directions
A switch delivers a unicast frame only to the port where the destination MAC lives. Port mirroring adds a second delivery: the hardware copies frames matching a source port (or VLAN, on some platforms) to a designated destination port, which stops acting as a normal switch port and only transmits copies. A capture host or IDS sensor plugs into it.
Mirroring is directional. Ingress (input) copies frames arriving at the source port from the attached device; egress (output) copies frames the switch sends out of it; both copies everything. Some platforms cannot mirror egress on every port type or strip VLAN tags from egress copies; check the capture for tags before diagnosing VLAN problems.
02 /Oversubscription: mirroring 10G to 1G
The destination port has one transmit direction; the source has two. A 1 gigabit source running flat out both ways produces 2 gigabits per second of copies for a destination that carries 1. A 10 gigabit source mirrored to 1 gigabit can be oversubscribed twenty to one. The switch silently discards the excess; the capture shows gaps and one-sided conversations. Avoid it by mirroring one direction, using a faster destination, filtering to a VLAN or host where supported, or using a TAP.
03 /Remote mirroring
When the capture host is on another switch, remote mirroring carries copies across the network, either in a dedicated mirroring VLAN trunked to the switch with the capture port (carrying nothing else, MAC learning disabled) or in a GRE-style tunnel to a remote address, which crosses routed boundaries at the cost of extra headers and possible MTU overrun. Both consume bandwidth on every link in between, so the oversubscription arithmetic applies to trunks and aggregated links too.
04 /TAP versus mirror port
| Property | Mirror / SPAN port | Network TAP |
|---|---|---|
| Fidelity | Best-effort; drops under load, may strip tags or errored frames | Every bit including corrupt frames, both directions |
| Impact on production | Config change only | Brief link outage to insert |
| Cost | Free if a spare port exists | Hardware per link, dual-input capture card |
| Best for | Troubleshooting, ad hoc capture | Permanent monitoring, forensics, high-speed links |
05 /Procedure: configure, capture, verify, remove
- 01
Choose the destination port and prepare the capture host
Pick a port at least as fast as the expected copy volume, with nothing in production attached; it will stop switching normal traffic. On the capture host strip the interface of protocols (no IP address, no discovery, no reassembly offloads) and capture to disk with a ring buffer.
- 02
Designate the mirror port
In global configuration on an IronWare-style switch the shape is
mirror-port ethernet 1/24, naming the destination. Other platforms use a monitor session with a destination statement. - 03
Enable monitoring on the source
On the source interface set the direction:
monitor both, ormonitor inputormonitor outputfor one direction. Newer releases name the destination, for examplemonitor ethernet 1/24 both. - 04
Start the capture and verify
Run
show monitorto confirm source, destination and direction, then start the capture filtered on a host known to be active behind the source port. Frames should appear within seconds. - 05
Check for drops, then remove the mirror
Compare destination counters with the sum of source counters over the same minute; a shortfall means oversubscription. When finished, remove the monitor statement and the mirror-port designation. A forgotten mirror copies production traffic to whatever is plugged in later.
mirror-port ethernet 1/24 interface ethernet 1/5 monitor both show monitor show mirror
06 /Verifying with a packet capture
Check three things. Bidirectionality: one TCP conversation should show both request and response segments; one side only means the direction is wrong or egress copies are unsupported. VLAN tags: a trunk source with no tags means the platform strips them. Drops: the capture tool reports kernel drops and the destination counters reveal discards. If any fail under load, narrow the mirror or move to a TAP. sFlow is the complement: sample every port cheaply to decide which deserves a full capture.
07 /Privacy and legal note
A mirror port captures the content of communications, not just headers. Most jurisdictions require that the network operator has a legitimate operational purpose, that users have been notified through an acceptable use policy, or both. Capture only what the investigation needs, store captures encrypted with a retention limit, and remove the mirror when done.
08 /Questions
What is the difference between port mirroring and SPAN?
None. SPAN (Switched Port Analyzer) is one vendor name; mirror port, monitor port and analyser port are others. All describe the switch copying frames from a source port or VLAN to a destination port for a capture device.
Why is my mirrored capture missing packets?
Usually oversubscription. A full-duplex source produces copies in both directions, so a 1 gigabit source can exceed a 1 gigabit destination, and 10 gigabit mirrored to 1 gigabit loses data under load. Mirror one direction, use a faster destination, or a TAP.
Does port mirroring affect the traffic being mirrored?
On a modern switch, no. The copy is made in hardware alongside normal forwarding and the source port keeps switching at full rate. Remote mirroring is the exception: copies consume bandwidth on the trunks they cross.
Can a mirror port see traffic between two hosts on other ports?
Only if one of those ports is the source, or the platform supports VLAN mirroring and both hosts are in the mirrored VLAN. A switch delivers unicast frames only to the destination port, so a mirror elsewhere sees only broadcasts and floods.
When should a TAP be used instead of a mirror port?
When every frame matters: forensics, compliance recording, high-speed links, or any capture that must include errored frames and exact timing. A TAP is passive and lossless. A mirror port is best-effort and can drop copies under load or strip VLAN tags.
Sources
- IEEE Std 802.1Q, Bridges and Bridged Networks
- IEEE Std 802.3, Ethernet
- The Tcpdump Group, tcpdump and libpcap manual pages
- Foundry Networks, Enterprise Configuration and Management Guide, chapter on configuring port mirroring and monitoring (original Foundry documentation, historical, around 2005)