What is port mirroring on switch?
The concept behind port mirroring is quite simple. When you configure a switch, you reserve one port. Then you configure the switch to “mirror” all traffic that passes through to that reserved port. Whenever the switch processes a packet, it makes a copy and sends it to whatever is connected to the aforementioned port.
What is a SPAN port used for?
A SPAN port (sometimes called a mirror port) is a software feature built into a switch or router that creates a copy of selected packets passing through the device and sends them to a designated SPAN port. Using software, the administrator can easily configure or change what data is to be monitored.
How to configure port mirroring on a router?
The prerequisite of configuring port mirroring is ensuring the network device (no matter a switch or router) supports port mirroring. And then select one mode, local port mirroring or remote port mirroring configuration. 1. Create a VLAN. 2. Add the source port and destination port to VLAN.
Where are source ports located in port mirroring?
All source ports are located on the same network device as the destination ports. As figure 1 shows, local port mirroring enables the network switch to forward the copy of the packet on the source port (Eth 1/1) to the destination port (Eth 1/2). Then the monitoring device connected with the destination port can monitor and analyze the packet.
How to configure port mirroring when deploying advanced threat?
For port mirroring, configure port mirroring for each domain controller to be monitored, as the source of the network traffic. Typically, you need to work with the networking or virtualization team to configure port mirroring. For more information, see your vendor’s documentation.
Is it port mirroring or promiscuous mode?
Purists will argue that putting your network card in promiscuous mode is not “port mirroring,” because your network card is not duplicating packets. They say the card is just dropping the requirement for its MAC address in order to recognize arriving packets and forward them to applications on your computer.