Remote ports mirroring 2

[Spack]

Hi,

I'm looking for a solution in order to monitor some ports on many OmniSwitches 6850 by many host. For redundancy purpose, I have 2 OmniSwitches in VRRP connected on each server. There is also 2 connections to the router but the links are a couple of optical fibers.

monitor.png

Here is the problem. Currently, we have a dedicated host on each couple of OmniSwitches, the backup switch sends its mirrored ports packets to the master one and the master switch mirrors the incomming packets from the backup and its own ports to the monitor port (see my previous topic about this viewtopic.php?f=86&t=5923). In this configuration, we can monitor both switches with only one link.

But now, I have many hosts and they don't want to look at the same ports on the OmniSwitches. For exemple, in my diagram, PC1 wants to look at Server 1 which is on ports 1 and Server 3 which is also on ports 1 but on another couple of OmniSwitches. And PC2, wants to look at Server 2 and Server 3. So, the solution of one monitor by couple of OmniSwitches became unmanageable because you have two hosts which don't want to look at the same ports and you have to switch between two monitors when you want to monitor 2 couple of OmniSwitches .

So, I wonder if there a solution to do a remote ports monitoring where which host select the port they want to see on any OmniSwitch.

I first think about making a parallele network only for monitoring. So, I can put each monitored packet in a VLAN for each host but I can't put plus than on mirroring session on a port and I need at least four ports (for four monitors) by couple of OmniSwitches so that makes a lot of ports used only for monitorring and I don't have all that ports available. I can only assign one or two ports for monitoring .

[cedric1]

Hello

Why did you not use Sflow with sampler = 0 to get all packet going through the port ?

This could perhaps help

[Spack]

Do you have some example on how to use sFlow?

I tried:

Code: Select all

sflow receiver 1 address 192.168.1.1 name "test"
sflow sampler 1 1/1 receiver 1

But I have no result...

[cedric1]

at this link exemple of sflow output config

you need to configure a poller and a sampler

sflow receiver 1 name Sflow_server address *.*.*.* udp-port 9996 packet-size 1400 version 5 timeout 0
sflow sampler 1 1/1 receiver 1 rate 1 sample-hdr-size 128
sflow poller 1 1/1 receiver 1 interval 5

http://eforum.esd.alcatel-lucent.com/vi ... 59f19#p486

[Spack]

I tried sFlow but what I got is statistics about the configured port but not the packets which pass through itself.

[benny]

Be aware that sFlow only gives you the header of the packets - not the payload. Depends what you need.
If this is about statistics, I would vote for sFlow.

For sFlow you need a sFlow collector software like InMon TrafficSentinel/sFlowTrend (www.inmon.com).

For full packet you will have to use the port mirroring feature.

I don't see why the remote port stuff doesn't help you. You will always have to configure something if you want to mirror.

As you are limited to two mirroring sessions on the OS6850 - I mean.

-benny