Port Mirroring (SPAN) Configuration on Cisco, Huawei, Arista and Juniper

Port mirroring - copying traffic from one port or VLAN to a monitoring port - is the foundation of network troubleshooting: packet capture, IDS/IPS inspection, and traffic analysis all depend on it. Every major switch OS implements it, but under different names and syntax: SPAN on Cisco, port mirroring on Huawei VRP, monitor sessions on Arista EOS, and analyzers on Junos. This guide gives you the exact commands for all four vendors so you can set up mirroring without re-reading manuals, plus a note on RSPAN for remote monitoring.

Cisco IOS: SPAN

Switch(config)# monitor session 1 source interface GigabitEthernet1/0/1 both
Switch(config)# monitor session 1 source vlan 10 rx
Switch(config)# monitor session 1 destination interface GigabitEthernet1/0/24
Switch(config)# end
Switch# show monitor session 1

both mirrors TX+RX; you can also choose rx or tx only. For RSPAN, configure a remote VLAN: monitor session 1 destination remote vlan 100 on the source switch and monitor session 1 source remote vlan 100 on the destination switch.

Huawei VRP: Port Mirroring (Observe Port)

[Huawei] observe-port 1 interface GigabitEthernet0/0/24
[Huawei] interface GigabitEthernet0/0/1
[Huawei-GigabitEthernet0/0/1] port-mirroring to observe-port 1 both
[Huawei-GigabitEthernet0/0/1] quit
[Huawei] display observe-port
[Huawei] display port-mirroring

The observe-port is the monitoring destination; multiple source ports can mirror to it. For VLAN mirroring: mirror to observe-port 1 under a VLAN view, or port-mirroring to observe-port 1 with the vlan keyword in newer VRP versions.

Arista EOS: Monitor Sessions

switch(config)# monitor session 1 source ethernet 1 both
switch(config)# monitor session 1 source ethernet 2-4 tx
switch(config)# monitor session 1 destination interface ethernet 24
switch(config)# end
switch# show monitor session
switch# show monitor session 1

EOS syntax mirrors Cisco closely but uses destination interface (no monitor session destination prefix).

Junos: Analyzers

set ethernet-switching-options analyzer MIRROR input ingress interface ge-0/0/1.0
set ethernet-switching-options analyzer MIRROR input egress interface ge-0/0/2.0
set ethernet-switching-options analyzer MIRROR output interface ge-0/0/24.0
run show ethernet-switching analyzer MIRROR

Junos uses the analyzer concept with explicit ingress/egress selection. On MX (routers) use forwarding-options port-mirroring with a port-mirroring instance instead.

Quick Reference Table

Best Practices and Pitfalls

• Mirroring doubles the traffic on the destination port - never mirror a full 100G trunk to a 1G monitoring port.
• On high-speed switches, prefer destination ports at the same speed as the source.
• Check CPU/mirroring counters - some platforms rate-limit mirrored traffic.
• For remote capture across switches use RSPAN (Cisco) or configure the analyzer on both ends (Junos remote analyzers).
• Verify with show monitor session / display port-mirroring before assuming the capture works.

Related: tcpdump packet capture guide and STP troubleshooting on Catalyst.

原文链接：https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html