Hello everybody,
I configured an EX4300 switch with an analyzer session whose input are packets entering a particular VLAN and sending those packet to multiple output interfaces following this known workaround: Configuring Multiple Port Mirroring Sessions on an EX4300 Switch
It is almost working, since I can see mirrored traffic on the "hub" interfaces, but is far less traffic compared to the traffic exiting the analyzer output interface. Let's say, on the output interface I see almost 900 Mbps, while on the "hub" interfaces where my analyzer devices are attached I see only 50 or 60 Mbps.
This is how I configured the analyzer:
show configuration forwarding-options analyzer MIRROR { input { ingress { vlan GuestVlan; } } output { interface ge-0/0/40.0; } } show configuration interfaces ge-0/0/40 description "MIRROR OUTPUT INTERFACE"; unit 0 { family ethernet-switching { storm-control default; } } show configuration interfaces ge-0/0/41 description "MONITORING LOOP INTERFACE"; unit 0 { family ethernet-switching { interface-mode access; vlan { members MIRROR; } } } show configuration interfaces ge-0/0/42 unit 0 { family ethernet-switching { interface-mode access; vlan { members MIRROR; } storm-control default; } }
Interfaces from ge-0/0/41 to ge-0/0/47 belong to the MIRROR vlan and are set with the "no-mac-learning" option. The loop link is between ports ge-0/0/40 and ge-0/0/41.
These are the traffic statistics on the interfaces:
show interfaces ge-0/0/40 ... Input rate : 0 bps (0 pps) Output rate : 967054528 bps (202390 pps) show interfaces ge-0/0/41 ... Input rate : 959416000 bps (250525 pps) Output rate : 0 bps (0 pps) show interfaces ge-0/0/42 ... Input rate : 0 bps (0 pps) Output rate : 30896064 bps (8170 pps)
As you can see, on ge-0/0/42 the output rate is much lower than what is seen on ge-0/0/40.
Any idea? Thank you in advance!