Streamer Flow Mirroring Configuration

Flow mirroring copies traffic from specified source ports or VLANs to a monitoring port for analysis, and can be configured locally or remotely using traffic policies or mirror flows.

Overview of Flow Mirroring

Flow mirroring allows network administrators to duplicate packets matching specific rules from a source port, VLAN, or interface to a designated observing or monitor port. The mirrored traffic can then be analyzed by monitoring devices for diagnostics, performance monitoring, or security purposes . Mirroring can be ingress (incoming), egress (outgoing), or bidirectional depending on the traffic direction you want to capture .

Local Mirroring Configuration

1. Define Source and Destination Ports: Identify the ports or VLANs to monitor (source) and the port connected to the monitoring device (destination). Multiple source ports can be mirrored to a single destination port, even across different VLANs .
2. Create a Mirroring Group: On devices like H3C switches, a local mirroring group is created to bind source ports and the monitor port .
3. Apply Traffic Policies: For MQC-based mirroring (Huawei), apply a traffic policy containing mirroring behaviors to the system, VLAN, interface, or VPN instance .
4. Configure Rules: Use access lists or flow rules to specify which traffic should be mirrored. Only traffic matching the rules will be copied .

Remote Mirroring (RSPAN)

Remote Switched Port Analyzer (RSPAN) allows mirroring across different switches. The source switch sends mirrored traffic to a remote VLAN, which is then forwarded through intermediate switches to the destination switch connected to the monitoring device . This eliminates the limitation of having source and destination ports on the same switch.

Flow Mirror Flows (Fibre Channel Example)

For Fibre Channel networks, Flow Mirror flows can be created using commands specifying:

• Flow name and mirror feature
• Ingress port (ingrport) and optionally source/destination devices
• Only certain ports (F_Port, Gen 6 F_Port, or logical port groups) are supported . Example command:

switch1234:admin> flow --create flowmirror14 -feature mirror -ingrport 14 -srcdev 080e00 -dstdev 080f00

This mirrors traffic from device 080e00 to 080f00 ingressing through port 14 .

Best Practices

• Limit the number of mirrored sessions to avoid performance degradation; some switches support a maximum number of mirror destination ports .
• Choose high-throughput ports for the monitor port to prevent packet loss .
• Use access lists or VLAN filters to mirror only relevant traffic, reducing unnecessary load on monitoring devices .
• Verify mirroring direction (ingress, egress, bidirectional) to capture the intended traffic .

By following these steps, you can configure flow mirroring effectively for both local and remote monitoring, ensuring accurate traffic analysis and network diagnostics.