[c-nsp] SPAN (forwarding mirrored traffic)

[Carl Neenan]

On Fri, 18 Mar 2005 15:57:27 +0100, Gert Doering <gert at greenie.muc.de> wrote:
> Hi,
> 
> On Thu, Mar 17, 2005 at 06:17:52PM +0000, Carl Neenan wrote:
> > Cisco               Juniper ERX     Juniper M-Series
> > 3550  Port0/0<--------->1440<------------>M10i<------>Transit
> >          +
> > Mirrored +
> > Traffic  +
> >          +             Foundry            Foundry
> > 3550  Port0/5<-------->BigIron<---------->BigIron<-------->sniffer
> >                                  dot1q
> [..]
> > I assumed the mirrored traffic would be flooded (unknown unicast mac
> > address) but what state are the MAC addresses on the mirrored
> > traffic??
> 
> Well... if you're sniffing both directions (TX and RX), the Foundry will
> see packets with both src MACs on the "mirrored port", and so the MACs
> are not "unknown" -> no flooding.
> 
> You'll need to have the Foundries mirror as well..
> 
> gert
> --
> USENET is *not* the non-clickable part of WWW!
>                                                            //www.muc.de/~gert/
> Gert Doering - Munich, Germany                             gert at greenie.muc.de
> fax: +49-89-35655025                        gert at net.informatik.tu-muenchen.de
> 

Hi Gert

thanks for the reply, so I guess I can do this also by only mirroring
Tx or Rx traffic?

Regards

Carl