Questions[port-mirroring](server)

I'm wanting to stress test an application I've written that takes in mirrored network traffic using Bro and processes it. I'd like to generate the traffic and present it to Bro in a way that's as similar as possible as what a mirrored switch port would do in production. I'm assuming mirrored packets are encapsulated in an Ethernet packet and sent out the configured egress port, but I don't know the specifics at all.

Can someone explain to me or point me to some documentation that describes the technical specifics of how mirrored packets are encapsulated and sent to the receiving party? My ultimate goal is to write a custom traffic generator to facilitate this unless something already exists. I don't have any captured traffic to replay, so I'm fine with having to craft the actual packets to be mirrored. I just need to figure out how to accurately simulate the mirroring of the packets.

For the sake of monitoring my internet connection I have set up a port mirror on my Dell powerconnect 5548 from the SFP port to a 1Gb port on the switch, connected to my monitoring interface. The SFP interface is the uplink port to my default gateway.

The port mirror is listed as being "active" within the switch interface but tcpdump is not picking anything up on the interface except broadcast traffic.

Any ideas for what could be wrong?

How would you enable port mirroring for a HP Procurve 5406ZL?

The configuration guide is not very clear in the mirror-port function. I know that I'll need to use the mirror-port [[ethernet] PORT-NUM] but it don't know (or how) should I go specifying the target port to be mirrored?

Does a port mirror send ethernet frames out of the switch-port with the 802.1Q header bytes still on the frame?

We have two network switches, a POE switch (SwitchA) to power our phones / users computers and a non-POE switch (SwitchB for the rest network.)

Each switch is setup to do port mirroring to support our VoIP recording system. SwitchA does port mirroring on specific ports if we need to record a user. SwitchB mirrors one port to monitor our work at home users (Internet comes in from managed router, to switch, back out to our firewall.) These two port mirroring setups feed into one vmware vSphere 4.1 server, it has four total physical cards. The other two NICs feed into an unmanaged switch for connecting to the rest of the network.

Once into the vSphere server all network ports go into a vSwitch, and then one of the servers (Windows 2008 R2) sniffs them out and does its thing.

Everything is working fine and dandy from SwitchB. But on SwitchA we only receive one side of the VoIP packets (going out to the phone, nothing coming in from the phone).

Troubleshooting steps I have taken so far:

• I hooked up my laptop to the monitor port on SwitchB and I see both sides of the packets.
• I swapped which network interface is plugged into the monitor port on SwitchA.

Because everything feeds into one vSwitch / vNetwork and both sides of the conversation arrive just fine from SwitchB I believe everything is configured correctly on the vSphere server/guest.

What could be causing one way packets to arrive on my guest machine from only one interface, but not the other? Could a bad cable be causing the problems from SwitchB?

Edit:

• I also enabled the monitor port on my switch to be in Trunk mode, instead of Access Mode.
• I set the vlanID to All(4095) on the VM Network.
• I turned Promiscuous mode = Accept for the vSwitch. (I had it off so my VoIP recording server didn't see all of the vSwitch traffic.)

Can a vSwitch have two vlanIDs? Could I set the vSwitch to have both 1 and 50 associated with it? It seems that because there is a drop down for either None (0) or All (4095) those are my options.