Monday, May 30, 2016

Configurable mirroring

Sometimes, you need to examine traffic on a network to troubleshoot a problem, or copy it to an intrusion detection system (IDS for example, Bro). You might want a copy of everything on a port; or you may want a copy of only certain traffic.

FAUCET allows you to mirror traffic at a port level, but also at a configurable fine grained level - for example, just Ethernet broadcasts. In the following example, we mirror broadcasts to port 3, and we forward everything else by default. 

When a port is the target of a mirror action, forwarding is disabled on that port.

interfaces:    
   1:
       native_vlan: 100        
       acl_in: 99    
   3:        
       native_vlan: 100
vlans:    
   100:        
       description: "untagged"
acls:    
   99:        
       - rule:            
         dl_dst: ff:ff:ff:ff:ff:ff            
         actions:                
           allow: 1                
           mirror: 3        
       - rule:            
         actions:                
           allow: 1

No comments:

Post a Comment

Note: Only a member of this blog may post a comment.