Traffic Mirroring Configuration Guide for Cisco 8000 Series Routers, Cisco IOS XR Release

PDF

Traffic mirroring terminology

Updated: March 2, 2026

Want to summarize with AI?

Log in

Overview

This topic explains the essential terms and concepts required to configure and troubleshoot network monitoring sessions effectively.

Understanding traffic mirroring terminology is essential for effective configuration and troubleshooting.

These are the key terms associated with traffic mirroring:

  • Ingress traffic: Traffic that enters the router.

  • Egress traffic: Traffic that leaves the router.

  • Source port: A port that the system monitors using traffic mirroring. It is also known as monitored port.

  • Destination port: A port that monitors the source ports. Usually, a network analyzer is connected here.

  • Monitor session: A collection of traffic mirroring configurations that consists of a single destination and many source interfaces.

Source port

A source port, as used in traffic mirroring, is a switched or routed port that

  • is monitored for network traffic analysis

  • supports monitoring of ingress or Rx traffic in a single local or remote mirroring session, and

  • supports source ports up to 800.

Characteristics of source port

A source port has these characteristics:

  • It supports any port type, such as Bundle Interface, sub-interface, 100-Gigabit Ethernet, and 400-Gigabit Ethernet.

  • It does not support Bridge group virtual interfaces (BVIs).

  • It can only be monitored in one traffic mirroring session at a time.

  • It cannot be a destination port.

  • It can be configured with a direction, ingress for monitoring. The direction applies to all physical ports in a bundle.

Monitor session

In traffic mirroring, a monitor session is a collection of traffic mirroring configurations that

  • consists of a single destination and can have several source interfaces

  • sends traffic from source interfaces or ports to a monitoring or a destination port

  • combines mirrored traffic streams at the destination port when multiple source ports are present, and

  • results in a mixture of traffic from one or more source ports at the destination port.

Characteristics of monitor session

Monitor sessions have these characteristics:

  • Each monitor session can have only one destination port.

  • Each destination port can belong to only one monitor session.

  • The destination of an ERSPAN monitoring session is either a GRE IPv4 or a GRE IPv6 tunnel.