Configuring a MAC address to filter mirrored traffic on an interface

Enter the monitor mac mirror command at the global configuration level.

Syntax 


no monitor mac mac-addr [src | dest | both] {mirror 1 - 4 | name-str} [1 - 4 | name-str] [1 - 4 | name-str] [1 - 4 | name-str]

Use this command to configure a source and/or destination MAC address as criteria for selecting traffic in one or more mirroring sessions on the switch. The MAC address you enter is configured to mirror inbound (src), outbound (dest), or both inbound and outbound (both) traffic on any port or learned VLAN on the switch.

monitor mac mac-addr

Configures the MAC address as selection criteria for mirroring traffic on any port or learned VLAN on the switch. 


{src | dest | both}
Specifies how the MAC address is used to filter and mirror packets in inbound and/or outbound traffic on the interfaces on which the mirroring session is applied:
  • src: Mirrors all packets in inbound traffic that contain the specified MAC address as source address.
  • dest: Mirrors all packets in outbound traffic that contain the specified MAC address as destination address.
NOTE:

The MAC address of the switch is not supported as either the source or destination MAC address used to select mirrored traffic.

  • both: Mirrors all packets in both inbound and outbound traffic that contain the specified MAC address as either source or destination address. 

mirror [1 - 4 | name-str]

Assigns the inbound and/or outbound traffic filtered by the specified MAC address to a previously configured mirroring session. The session is identified by a number or (if configured) a name.

Depending on how many sessions are configured on the switch, you can use the same command to configure a MAC address as mirroring criteria in up to four sessions. To identify a session, you can enter either its name or number; for example: mirror 1 2 3 traffsrc4

1 - 4: Specifies a mirroring session by number, for which the configured MAC address is used to select and mirror inbound and/or outbound traffic.

Packets that are sent or received on an interface configured with a mirroring session and that contain the MAC address as source and/or destination address are mirrored to a previously configured destination device.

To remove a MAC address as selection criteria in a mirroring session, you must enter the complete Command syntax, for example, no monitor mac 998877-665544 dest mirror 4.

The no form of the command removes the MAC address as a mirroring criteria from an active session, but does not remove the session itself. This enables you to repurpose a session by removing an unwanted mirroring criteria and adding another in its place.