Packet Mirroring Configuration

SentriaOne xSIEM analyzes network traffic from a copy of the packets on your network. This page explains how to send that copy to the SentriaOne xSIEM sensor using switch port mirroring (SPAN) or a network packet broker.

For background on how packet mirroring works and where to mirror, see Packet Mirroring in the Concept section.

Deployment options

Option	Suitable when
Switch SPAN	Traffic to be monitored passes through one or a few switches, and the switch has a free port for mirroring
Network TAP	A critical link must be copied completely and reliably, independent of switch load
Packet broker	Traffic comes from many switches, TAPs, or sites; or needs filtering, deduplication, or load balancing before analysis

Before you start

Item	Description
Sensor capture interface	The SentriaOne xSIEM sensor interface that receives mirrored traffic. Provided by your deployment team
Destination port	A free switch port, cabled to the sensor capture interface, with enough speed for the mirrored traffic
Sources	The switch ports or VLANs whose traffic should be analyzed
Direction	Mirror both directions (received and transmitted) so sessions can be fully analyzed

Choosing the sources

• Internet uplink / firewall inside interface — covers north-south traffic between users/servers and the internet.
• Server and core VLANs — covers east-west traffic between internal systems, where lateral movement happens.
• Uplinks between switches — covers traffic from many access ports with a single source.

Capacity

The total mirrored traffic must fit in the destination port. For example, mirroring two busy 1 Gbps ports in both directions can produce up to 4 Gbps, which a single 1 Gbps destination port cannot carry. Excess packets are dropped. Use a faster destination port, fewer sources, or a packet broker.

Configuring SPAN on common switches

In the examples, replace interface names and VLAN numbers with your own. Commands can differ between models and software versions — refer to your vendor documentation for details.

note

A SPAN destination port only sends mirrored traffic to the sensor. It no longer acts as a normal switch port, so do not use a port that carries other connections.

Cisco Catalyst (IOS / IOS XE)

Mirror two access ports in both directions to port Gi1/0/24:

configure terminal
 monitor session 1 source interface GigabitEthernet1/0/1 - 2 both
 monitor session 1 destination interface GigabitEthernet1/0/24
 end

To mirror a whole VLAN instead of individual ports:

configure terminal
 monitor session 1 source vlan 10 rx
 monitor session 1 destination interface GigabitEthernet1/0/24
 end

Check the session:

show monitor session 1

A session uses either source ports or source VLANs. Mirroring a VLAN with rx captures traffic entering the VLAN and avoids duplicate packets for traffic between two hosts in the same VLAN.

Cisco Nexus (NX-OS)

On NX-OS the destination port must be set to monitor mode, and the session must be enabled with no shut:

configure terminal
 interface ethernet 1/24
  switchport
  switchport monitor
  no shutdown
 monitor session 1
  source interface ethernet 1/1 both
  source vlan 10 rx
  destination interface ethernet 1/24
  no shut
 end

Check the session:

show monitor session 1

Juniper EX (Junos with ELS)

Mirror ingress and egress traffic of ge-0/0/1 to ge-0/0/23:

set forwarding-options analyzer SENTRIAONE input ingress interface ge-0/0/1.0
set forwarding-options analyzer SENTRIAONE input egress interface ge-0/0/1.0
set forwarding-options analyzer SENTRIAONE output interface ge-0/0/23.0
commit

Check the analyzer:

show forwarding-options analyzer

Older EX software without ELS uses ethernet-switching-options analyzer instead of forwarding-options analyzer.

Aruba CX (AOS-CX)

Mirror port 1/1/1 in both directions to port 1/1/24:

configure terminal
 mirror session 1
  source interface 1/1/1 both
  destination interface 1/1/24
  enable
 end

Check the session:

show mirror 1

VMware vSphere Distributed Switch

To analyze traffic between virtual machines, mirror it on the distributed switch to the sensor virtual machine (or to an uplink connected to a physical sensor):

1. In the vSphere Client, select the distributed switch and go to Configure › Port Mirroring, then select New.
2. Choose the session type — for example Distributed Port Mirroring when the sensor VM is on the same host as the monitored VMs.
3. Name the session and enable it.
4. Select the sources: the ports of the monitored VMs, with traffic direction Ingress/Egress.
5. Select the destination: the port of the sensor VM's capture interface.
6. Finish the wizard.

Using a network packet broker

A network packet broker (NPB) sits between the mirror sources and the sensor. It is recommended for larger or distributed environments.

Function	Benefit
Aggregation	Combines traffic from many SPAN ports and TAPs into the sensor capture interface
Filtering	Sends only relevant traffic (for example specific VLANs or subnets) and drops the rest
Deduplication	Removes duplicate packets seen at more than one mirror point
Load balancing	Spreads traffic across multiple sensors or capture interfaces while keeping each session together
Header stripping	Removes VLAN tags or tunnel encapsulation (for example ERSPAN) before traffic reaches the sensor
Speed conversion	Connects high-speed links (for example 10/40/100 Gbps) to sensor interfaces

To use a packet broker:

1. Connect the SPAN destination ports and TAPs to the packet broker's input (network) ports.
2. Connect the SentriaOne xSIEM sensor capture interface to a packet broker output (tool) port.
3. Create a traffic map from the inputs to the output, adding filters and deduplication as required.
4. Make sure the output port speed matches or exceeds the traffic sent to the sensor.

tip

If mirrored traffic must travel across a routed network (for example with ERSPAN or other encapsulated remote mirroring), confirm with your deployment team that the sensor accepts that encapsulation, or let the packet broker remove it.

Verifying the mirror

After configuring mirroring, check in the SentriaOne xSIEM dashboard:

Check	Expected result
Data Feed Health › SPAN Feed	Status LIVE and mirrored traffic seen recently
Data Feed Health › SPAN Presence	Mirrored traffic rate above zero
Network Overview	Traffic, connections, and hosts from the mirrored segments appear
Assets	Devices from the mirrored segments are discovered

If traffic does not appear:

1. Confirm the mirror session is enabled and shows the expected sources and destination (show monitor session, show mirror, or equivalent).
2. Confirm the destination port is cabled to the sensor capture interface and the link is up.
3. Check the switch interface counters on the destination port — output packets should increase.
4. Check that the destination port is not oversubscribed (output drops).