Packet Header for Mirrored Traffic Sent to Mediation Device
When the router sends mirrored traffic to the mediation device, it encapsulates the mirrored payload in a packet header before it sends the mirrored traffic to the mediation device.
Figure 1 is the mirrored packet header that the router sends to the mediation device.
Figure 1: Mirrored Packet Header
Table 1 describes the fields in the packet header of mirrored packets.
Table 1: Mirrored Packet Header and Payload Field Descriptions
Field | Value | Length (Bits) |
|---|---|---|
IP Header | ||
Version | 4 | 4 |
IHL | 5 | 4 |
Type of Service | 0 | 8 |
Total Length | Dynamically computed | 16 |
Identification | Dynamically computed | 16 |
Flags | Dynamically computed | 3 |
Fragment Offset | Dynamically computed | 13 |
Time to Live | 255 | 8 |
Protocol | 17 | 8 |
Header Checksum | Dynamically computed | 16 |
Source Address | IP address of the router interface that sends mirrored traffic to the mediation device | 32 |
Destination Address | IP address of the mediation device to which mirrored traffic is forwarded. This value is taken from the X-JTap-Cdest-Dest-Address attribute that is sent to the router in the DTCP ADD command. | 32 |
UDP Header | ||
Source Port | UDP port number on the router from which mirrored traffic is sent to the mediation device | 16 |
Destination Port | UDP port on the mediation device to which mirrored traffic is forwarded. This value is taken from the X-JTap-Cdest-Dest-Port attribute that is sent to the router in the DTCP ADD command. | 16 |
Length | Dynamically computed | 16 |
Checksum | 0 | 16 |
Mirror Header | ||
V (mirror header value) | 0 | 2 |
Intercept ID | Value of the X-MD-Intercept-Id that is sent to the router in the DTCP ADD command. | 30 |
