traffic mirror vs port mirror ??

[jacob600]

Can someone  explain the difference in traffic mirroring vs port mirroring?

Also, what is this mirror-to-cpu command? when would I use it? Is it really sending traffic to the cpu? How?

mirror-to cpu
 
Syntax
mirror-to cpu

undo mirror-to cpu

View
Traffic behavior view

Default level
2: System level

Parameters
cpu: Mirrors traffic to the CPU.

Description
Use the mirror-to cpu command to configure the action of mirroring traffic to the CPU for the traffic behavior.

Use the undo mirror-to cpu command to remove the action.

By default, the action of mirroring traffic to the CPU is not configured for a traffic behavior.

In a traffic behavior, the action of mirroring traffic to an interface and the action of mirroring

[mertdemi]

Hi Jacob,

With port mirroring you copy every packet passing through the interface.

With traffic mirroring you have the option to copy only selected traffic so your monitoring device does not need to proccess uninteresting traffic.

mirror-to-cpu copies interesting traffic to cpu. Honestly I did not have to use it so far in all my cases users did not want to copy everything from one port to another and they have used traffic mirroring.

also port mirroring is more scalable solution and with traffic mirroring has some limitations  like you can apply policy to one direction at the interface.

[Jackwill]

Port Mirroring, also known as SPAN (Switched Port Analyzer), is a method of monitoring network traffic. With port mirroring enabled, the switch sends a copy of all network packets seen on one port (or an entire VLAN) to another port, where the packet can be analyzed