Packet Mirroring
Packet mirroring is the practice of sending a copy of network packets to an analysis system, while the original packets continue to their destination unchanged.
Packet mirroring is how SentriaOne xSIEM receives raw traffic, the second data input alongside logs. It enables network-based analysis such as NDR and NPM.
How it works
The analysis system receives the copy passively (out of band). It is not in the path of production traffic, so:
- It does not add latency to production traffic.
- If the analysis system is unavailable, production traffic is not affected.
- It observes traffic; it does not block traffic directly. Response actions are handled separately (see Incident Response).
Why raw traffic matters
Logs only contain what a device decides to record. Raw traffic shows what actually crossed the network, which allows analysis of:
- Communication between systems, including systems that do not produce logs
- Protocol behaviour across network layers (L2–L7)
- Suspicious patterns such as scanning, lateral movement, or unusual data transfers
- Files transferred over the network, for malware analysis
- Application and network performance, such as slow responses or retransmissions
Mirroring methods
The following methods are common across network environments.
| Method | Description |
|---|---|
| SPAN / port mirroring | A switch copies traffic from selected ports or VLANs to a designated monitoring port |
| Remote SPAN | Mirrored traffic is carried to a monitoring port on a different switch |
| Network TAP | A dedicated hardware device placed on a link that copies all traffic passing through it |
| Virtual switch mirroring | A hypervisor's virtual switch mirrors traffic between virtual machines |
| Cloud traffic mirroring | A cloud provider service mirrors traffic from cloud network interfaces |
This table describes general methods. Configuration examples for common switches and packet brokers are in Integration › Packet Mirroring. Sensor requirements and sizing guidance are provided by your SentriaOne xSIEM deployment team.
Where to mirror: north-south and east-west
| Traffic direction | Description | What it helps detect |
|---|---|---|
| North-south | Traffic between the internal network and the internet | Inbound attacks, outbound command-and-control, data exfiltration |
| East-west | Traffic between systems inside the internal network | Lateral movement, internal scanning, misuse of internal services |
Perimeter controls usually see north-south traffic only. Attackers who are already inside the network move east-west, which is why mirroring internal traffic is important for network detection.
Planning considerations
- Coverage — mirror the segments that carry critical assets. Traffic that is not mirrored cannot be analyzed.
- Capacity — the total mirrored traffic must not exceed what the monitoring port and sensor can receive. Oversubscribed mirror ports drop packets.
- Both directions — mirror both inbound and outbound traffic of a link so sessions can be fully reconstructed.
- Duplicates — mirroring the same traffic at multiple points can create duplicate packets.
- Encrypted traffic — the payload of encrypted sessions cannot be read, but connection metadata (addresses, ports, timing, volume, and handshake information) is still available for analysis.
- Multiple sites — distributed environments typically place a sensor at each site or segment to be monitored.
- Data protection — mirrored traffic may contain sensitive data. Apply access control and retention policies consistent with your organization's regulations.