Port mirroring is used to send traffic to the probe. Care should be taken when setting up port mirroring to ensure that no packet flow is mirrored more than once. Counting some packets twice and others once will systematically bias the results. A worst-case example would be to apply output mirroring to multiple ports. This would have the effect of selectively amplifying the broadcast and multicast traffic by the number of ports.

Applying the "mirror once" rule yields two valid configurations:

1. Mirror inbound and outbound traffic on a single interface, typically used to monitor uplink traffic from a workgroup switch.
2. Mirror inbound traffic on multiple interfaces, typically used to monitor multiple ports on a backbone switch.

Workgroup

Figure 1 shows a departmental switch connected via a high-speed uplink to a backbone switch. The departmental switch is configured to mirror traffic in both directions on the uplink.

Figure 1 Using a probe to monitor a departmental switch

The following commands configure port mirroring on a departmental switch where the probe is connected to port 4/1 and that the uplink is on port 4/2.

Note: The example commands are for a Foundry BigIron switch. Consult the documentation for your switch for instructions on configuring port mirroring.

Backbone

Figure 2 shows a backbone switch. By monitoring input traffic on all the switch ports, all traffic on the switch is seen.

Figure 2 Using a probe to monitor a backbone switch

The following commands configure port mirroring for a backbone switch where the probe is connected to port 1/1 and where ports 1/2, 2/1 and 2/2 are to be monitored.

Note: The example commands are for a Foundry BigIron switch. Consult the documentation for your switch for instructions on configuring port mirroring.