Port mirroring on ProCurve 2610 / J9088A

[4J]

The documentation is not clear about how the switch handles mirrored tagged traffic. If I'm mirroring a port that has 10 VLANs defined on it, then what do I see on the mirroring port? Tagged or untagged traffic (from 10 VLANs)? It seems I can add as many VLANs as I want on the mirroring port (where the traffic is being copied to), and that's a little confusing.

I would have thought that the switch will strip the tags before sending the traffic out on the mirroring port, and that on that port you would usually have only some native VLAN defined.

If it doesn't (strip the tags before sending the traffic out on the mirroring port), then does it mean that I *have* to have the same VLANs defined on the mirroring port? Or I can just have some native one, and the switch will send the mirrored tagged traffic out on that port anyway? After all, that's the purpose of mirroring traffic, right?

The reason I'm confused is because the switch doesn't complain that the mirroring (where the traffic is being copied to) port doesn't have (at least) the same VLANS as the mirrored (where the traffic that I'm copying goes out to) port.

Does anyone has more information about this functionality? Google didn't help. Thanks in advance.

[paulgear · Accepted solution]

The mirroring port will be sent exactly what comes in on the port(s) you're mirroring.  If it's tagged, you'll get tagged.  If it's untagged you'll get untagged.  Otherwise, the mirroring would not give you an accurate picture of what is coming in on the monitored port(s).

This is in addition to what normally would be sent to that port, given its configuration.  So, for example, if the mirroring port is untagged on VLAN 10 and tagged on VLAN 60, and you're mirroring a port that is untagged in VLAN 20 and tagged in VLAN 30, 40, and 50, your mirror port will receive its usual traffic (e.g. broadcasts) untagged on VLAN 10 and tagged on VLAN 60, plus all relevant traffic from the mirrored port, including untagged traffic from VLAN 20, and tagged from VLANs 30, 40, and 50.  So this means it will receive untagged traffic from VLAN 10 (some) and VLAN 20 (all) mixed together.

For this reason, i keep my monitoring port untagged in a VLAN with no other ports, so that only mirrored traffic will be seen on it.  Hope that helps to clarify it.

[paulgear]

Note also that the mixed untagged VLANs thing only applies to traffic being sent OUT the monitor port.  The normal port configuration is used for all traffic coming IN the monitor port (e.g. DHCP requests from your monitoring PC).

[4J]

@paulgear,

Thanks a lot for your concise clarifications. I believe the documentation should include these details as they are important. I hope HP is monitoring these boards.