Technical Documentation

Understanding Port Mirroring on EX Series Switches

Use port mirroring to facilitate analyzing traffic on your Juniper Networks EX Series Ethernet Switch on a packet level. Use port mirroring as part of monitoring switch traffic for such purposes as enforcing policies concerning network usage and file sharing, and identifying sources of problems on your network by locating abnormal or heavy bandwidth usage from particular stations or applications.

Port mirroring copies packets entering or exiting a port, or entering a VLAN in a Juniper Networks EX3200 or EX4200 Ethernet Switch or exiting a VLAN in a Juniper Networks EX8200 Ethernet Switch, to either a local interface for local monitoring or to a VLAN for remote monitoring.

Port Mirroring Overview

Port mirroring is needed for traffic analysis on a switch because a switch, unlike a hub, does not broadcast packets to every port on the device. The switch sends packets only to the port to which the destination device is connected. You configure port mirroring on the switch to send copies of unicast traffic to either a local analyzer port or an analyzer VLAN. Then you can analyze the mirrored traffic using a protocol analyzer application. The protocol analyzer application can run either on a computer connected to the analyzer output interface or on a remote monitoring station.

We recommend that you disable port mirroring when you are not using it, and select specific interfaces as input to the port mirror analyzer in preference to using the all keyword option. You can also limit the amount of mirrored traffic by using statistical sampling, setting a ratio to select a statistical sample, or using a firewall filter. Mirroring only the necessary packets reduces any potential performance impact.

With local port mirroring, traffic from multiple ports is replicated to the analyzer output interface. If the output interface for an analyzer reaches capacity, packets are dropped. You should consider whether the traffic being mirrored exceeds the capacity of the analyzer output interface.

You can use port mirroring on a switch to mirror any of the following:

Packets entering or exiting a port—In any combination (up to 256 ports). For example, you can send copies of the packets entering some ports and the packets exiting other ports to the same local analyzer port or analyzer VLAN.
Packets entering a VLAN in an EX3200 or EX4200 switch—You can mirror the packets entering a VLAN in an EX3200 or EX4200 switch to either a local analyzer port or to an analyzer VLAN. You can configure multiple VLANs (up to 256 VLANs), including a VLAN range and PVLANs, as ingress input to an analyzer.
Packets exiting a VLAN in an EX8200 switch—You can mirror the packets exiting a VLAN in an EX8200 switch to either a local analyzer port or to an analyzer VLAN. You can configure multiple VLANs (up to 256 VLANs), including a VLAN range and PVLANs, as egress input to an analyzer.
Statistical sample—Sample of the packets entering or exiting a port or entering a VLAN in an EX3200 or EX4200 switch or exiting a VLAN in an EX8200 switch. Specify the sample number of packets by setting the ratio. You can send the sample of packets to either a local analyzer port or to an analyzer VLAN.
Policy-based sample—You can mirror a policy-based sample of packets that are entering a port or a VLAN. You can configure a firewall filter to establish a policy to select certain packets. You can send the sampled packets to a local analyzer port or to an analyzer VLAN.

Note: Juniper Networks JUNOS Software for EX Series switches implements port mirroring differently than other JUNOS Software packages. JUNOS Software for EX Series switches does not include the port-mirroring statement found in the edit forwarding-options level of the hierarchy of other JUNOS Software packages, nor the port-mirror action in firewall filter terms.

Limitations of Port Mirroring

Port mirroring on EX Series switches has the following limitations:

On an EX3200 or an EX4200 switch, you can enable only one analyzer (port mirroring configuration).
On EX8200 switches, you can configure seven analyzers (port mirroring configurations). Of these, one can be configured for input and output, the others only for output configured using firewall filters—the action of the firewall filters provides the input to the analyzers.
An analyzer configured using a firewall filter does not support mirroring of packets that are egressing ports.
Packets with physical layer errors are filtered out and thus are not sent to the analyzer port or analyzer VLAN.
You cannot mirror packets exiting or entering the following ports:
- Dedicated Virtual Chassis ports (VCPs)
- Management port (me0 or vme0)
- Routed VLAN interfaces (RVIs) and VLAN-tagged L3 interfaces
On EX3200 and EX4200 switches, mirrored packets exiting a tagged interface might contain incorrect VLAN ID and Ethertype.
On EX8200 switches, if you configure port mirroring to mirror packets egressing from 10-Gigabit Ethernet ports, packets might be dropped in the network traffic and in the mirrored traffic.
On EX8200 switches, you can set a ratio only for ingress packets.
On EX8200 switches, when an egress VLAN that belongs to a routed VLAN interface (RVI) is configured as the input for a port mirroring analyzer, the analyzer appends an incorrect dot1q (802.1Q) header to the mirrored packets on the routed traffic or does not mirror any packets on the routed traffic. As a workaround, configure a port mirroring analyzer with each port of the VLAN as egress input.
Mirrored packets exiting an interface do not reflect the rewritten DSCP or 802.1p bits.

Table 1 lists some port mirroring terms and their description.

Port Mirroring Terminology

Table 1: Port Mirroring Terminology

Term	Description
Analyzer	A port-mirroring configuration on an EX Series switch. The analyzer includes: The name of the analyzer Source (input) ports or VLAN (optional) A destination for mirrored packets (either a monitor port or an monitor VLAN) Ratio field for specifying statistical sampling of packets (optional) Loss-priority setting
Analyzer output interface Also known as monitor port	Interface to which mirrored traffic is sent and to which a protocol analyzer application is connected. Note: Interfaces used as output for a port mirror analyzer must be configured as family ethernet-switching. Analyzer output interfaces have the following limitations: Cannot also be a source port. Cannot be used for switching. Do not participate in Layer 2 protocols, such as Spanning Tree Protocol (STP), when part of a port mirroring configuration. When configured as an analyzer output interface, they lose any existing VLAN associations. If the bandwidth of the analyzer output interface is not sufficient to handle the traffic from the source ports, overflow packets are dropped.
Analyzer VLAN Also known as monitor VLAN	VLAN to which mirrored traffic is sent. The mirrored traffic can be used by a protocol analyzer application. The monitor VLAN is spread across the switches in your network.
Firewall-based Analyzer	An analyzer session that has only an “output” stanza. Firewall based Analyzer must be used along with firewall to achieve the functionality of an analyzer.
Input interface Also known as mirrored ports or monitored interfaces	An interface on the switch that is being mirrored, either on traffic entering or exiting the interface. An input interface cannot also be an output interface for an analyzer.
Mirror ratio	See statistical sampling.
Monitoring station	A computer running a protocol analyzer application.
Native analyzer session	An analyzer session that has both “input” and “output” stanzas.
Policy-based mirroring	Mirroring of packets that match the match items in the defined firewall filter term. The action item analyzer analyzer-name is used in the firewall filter to send the packets to the port mirror analyzer.
Protocol analyzer application	An application used to examine packets transmitted across a network segment. Also commonly called network analyzer, packet sniffer, or probe.
Remote port mirroring	Functions the same as local port mirroring, except that the mirrored traffic is not copied to a local analyzer port but is flooded into an analyzer VLAN that you create specifically for the purpose of receiving mirrored traffic. In the intermediate switch, you can avoid flooding of the mirrored traffic to the member ports of the VLAN by setting the “ingress only” attribute to the incoming ports of the VLAN and the “egress only” attribute to the outgoing port of the VLAN.
Statistical sampling	You can configure the system to mirror a sampling of the packets, by setting a ratio of 1:x, where x is a value from 1 through 2047. For example, when the ratio is set to 1, all packets are copied to the analyzer. When the ratio is set to 200, 1 of every 200 packets is copied.

Choose Country

North America

Europe

Asia Pacific