Port mirroring traffic in same subnet

General questions
,
1

Hi there,

I’m trying to setup a span port where traffic from a specific interface is mirrored on another interface. The interface has a DHCP server configured and other hosts are connected to this network as well. The main idea is that all traffic between those hosts are mirrored to another interface.

What works:

  • Traffic to/from other networks is mirrored and visible on the interface

What does not work:

  • Traffic to hosts on the same network.

This is the config

######## Interfaces - Lab01
set interfaces ethernet eth6 address '192.168.20.1/24'
set interfaces ethernet eth6 description 'Lab01'
set interfaces ethernet eth6 mac '00:0C:29:DB:4C:BD'
set interfaces ethernet eth6 mtu '1500'

######## DHCP - Lab01
set service dhcp-server shared-network-name lab01 subnet 192.168.20.0/24 default-router '192.168.20.1'
set service dhcp-server shared-network-name lab01 subnet 192.168.20.0/24 name-server '192.168.20.5'
set service dhcp-server shared-network-name lab01 subnet 192.168.20.0/24 domain-name 'lab01.local'
set service dhcp-server shared-network-name lab01 subnet 192.168.20.0/24 lease '86400'
set service dhcp-server shared-network-name lab01 subnet 192.168.20.0/24 range 0 start '192.168.20.30'
set service dhcp-server shared-network-name lab01 subnet 192.168.20.0/24 range 0 stop '192.168.20.100'

######## Mirror traffic from lab01 to eth7
set interfaces ethernet eth7 description "Lab01 Spanport"
set interfaces ethernet eth6 mirror ingress eth7
set interfaces ethernet eth6 mirror egress eth7

My questions:

  • Why is traffic on the same network not mirrored to the span port?
  • How can I make this work? Preferably, I don’t want to create seperate VLANs manually for each host.

Thanks!

2

Hi,

traffic is not mirrored on your span port because unicast traffic within the same subnet does not go through the router. So, the router doesn’t see it and cannot mirror it.

There are 2 solutions

  1. The correct solution: Configure a SPAN port on your switch. You switch sees all traffic and, depending on the switch, can dump in on a SPAN port

  2. The wrong solution: Configure proxy-arp on your router.This is wrong because ALL traffic will flow through your router. It might cause very funny side effects.