Sometimes it's handy to get a copy of packets
so that we can analyze or take a look at them.
In this Nugget, I'd like to chat with you about a concept called
port-mirroring, where we can take the packets
and frames from one area of our network,
or one port on a switch, and then forward
those to another port, where we can take a closer look at them.
So here is our topology.
And let's say the scenario is that this server here, which
is connected to gig 0/4 on switch two
is having some problems with network connectivity
or it's not operating correctly.
As so we want to take a look at all the packets on that port
so we can take a closer look.
Well, how do we go about doing that?
Well, one way is we can install some software on the server
to actually take a look at those packets.
However, that's going to interrupt the server
because it's also going to have to process the packet analyzer
to capture those packets.
Another option is we could do port mirroring, which
is to tell the switch dear, Mr. switch two,
please take all of your traffic that's
going into or out of gig 0/4, and let's
send a copy of all of those packets and frames
over to another device where we can analyze those packets.
And so for our discussion, let's choose computer two
as the lucky winner, the recipient who's
going to get a copy of all the traffic that
goes in and out of gig 0/4.
So from a switch perspective, we need to first of all,
identify where does computer two live, where is it connected.
And computer two is connected to this port
right here which is gig 0/2.
So depending on the vendor's equipment,
we configure this switch, switch two,
to copy the packets from gig 0/4,
and send a copy of all that traffic
to the destination interface of gig 0/2, at which point
computer two would need to be running some software
or something that can look at all those packets
so we could analyze them.
So in a Cisco environment, when where
we're doing the mirroring, the port mirroring
on a local switch, they refer to it
as SPAN, which is an acronym for switched port analyzer.
And even within a specific vendor
based on the hardware and the version of software that's
being used on that switch, the commands could also vary.
So here's an example of the commands
we could use on a Cisco switch, monitor session and a number.
For example, session number one, which
is just identifying that SPAN session in the switch.
And we'd use the source keyword, and then
specify interface gig 0/4.
That's were we want to pull the data or the frames from.
And then the second line is to specify
where we want those copies of the frames to go.
And we use the command monitor session 1 destination.
And then the interface where our monitoring device
is, it's going to collect those packets.
In this case, it's the Windows machine computer
two on port gig 0.2.
And that would cause the switch, switch two,
to take all the frames on port gig 0/4
and mirror them or copy them over to gig 0/2 for analysis.
In this Nugget, we've taken a look
at the concept of port mirroring and how
it can be used to copy packets from one area of our network
over to another for analysis.
I hope this has been informative for you,
and I'd like to thank you for viewing.