Extreme Switch Port-Mirroring for Packet Capture

Next .. implement port mirroring for Extreme network switch.
Hope this is usefull for you as reference.


#### Adds ports 1, 2, 3, and 5 to the port list
Extreme# config mirror add port 1,2,3,5

#### Delete port 2 from the port list
Extreme# config mirror del port 2


#### Enable result mirror traffic to port 8
Extreme# enable mirror to port 8 

#### Disable
Extreme# disable mirror

#### Newer version (Enable result mirror traffic to port 8)
Extreme# enable mirroring on port 8


#### Displays port mirroring information
Extreme# show mirroring 

Juniper Port Mirror for Packet Capture

Next is example config for packet capture in Juniper OS (JunOS).

set interfaces ge-0/0/0 unit 0 description "Source Port"
set interfaces ge-0/0/0 unit 0 family inet filter input mirror
set interfaces ge-0/0/0 unit 0 family inet filter output mirror
set interfaces ge-0/0/0 unit 0 family inet address 172.16.20.1/30

set interfaces ge-7/0/0 unit 0 description "Result Port (TCPdump/Wireshark)"
set interfaces ge-7/0/0 unit 0 family inet address 192.168.0.1/30

set forwarding-options port-mirroring mirror-once
set forwarding-options port-mirroring family inet input rate 1
set forwarding-options port-mirroring family inet output interface ge-7/0/0.0 next-hop 192.168.0.2
set forwarding-options port-mirroring family inet output no-filter-check

set firewall filter mirror term Mirror then port-mirror
set firewall filter mirror term Mirror then accept

ref.
Cisco IOS Port Mirroring for Packet Capture
Cisco IOS embedded packet capture

Cisco IOS Port Mirroring for Packet Capture

Last week, I have posted about Cisco IOS embedded packet capture. All procedure was did in (internal) Cisco device. If you concern about high CPU and memory because of that, You can use external packet capture (example: TCPdump, Wireshark). Cisco device need some config to do external packet capture.

Please find the config

#### Port source mirror
IOS(config)# monitor session 1 source interface fastethernet 0/1

#### Port for result mirror (TCPdump/Wireshark)
IOS(config)# monitor session 1 destination interface fastethernet 0/24

#### Verify
IOS# show monitor session 1