3.2 Given a scenario, use network monitoring technologies
Methods
📘CompTIA Network+ (N10-009)
Definition:
Port mirroring is a network monitoring technique where a network switch copies (or “mirrors”) the traffic from one port (or multiple ports) to another port. The mirrored port is usually connected to a network monitoring device, such as a packet analyzer or intrusion detection system (IDS).
Think of it as making a duplicate of the traffic for inspection without affecting the original flow of data.
Key Concepts
- Source Port
- This is the port (or ports) on a switch whose traffic you want to monitor.
- Example: If you want to monitor a server, the switch port connected to that server is the source port.
- Destination Port
- This is the port on the switch that receives a copy of all the traffic from the source port.
- Example: A network analyzer or IDS is connected to the destination port to analyze traffic.
- Unidirectional Traffic
- Port mirroring usually copies traffic in one direction (ingress = incoming, egress = outgoing, or both).
Why It’s Used in IT Environments
Port mirroring is commonly used for:
- Network Analysis
- Capturing traffic for troubleshooting.
- Example: If users report slow access to a file server, mirroring the server port allows an admin to analyze network traffic and identify bottlenecks.
- Security Monitoring
- Detecting unauthorized access or attacks.
- Example: Sending mirrored traffic to an intrusion detection system (IDS) to watch for malicious behavior, like a hacker scanning the network.
- Performance Monitoring
- Checking bandwidth usage and identifying congested network segments.
- Example: Monitoring the port of a database server to see how much traffic it handles during peak hours.
How Port Mirroring Works
- Admin configures a switch to mirror traffic from the source port (server, router, or other devices) to the destination port (monitoring device).
- The switch duplicates all packets (incoming, outgoing, or both) from the source port.
- The monitoring device receives these packets without affecting the original network flow.
- Tools like Wireshark or IDS systems analyze the mirrored traffic in real-time.
Advantages
- Non-intrusive: Traffic is copied, not interrupted.
- Helps with troubleshooting and security monitoring.
- Works on both wired and virtual networks.
Limitations
- Can cause high CPU usage if mirroring a very busy port.
- Switch ports must support mirroring (not all low-end switches do).
- Only provides traffic visibility for the mirrored ports, not the entire network unless multiple ports are mirrored.
Common Exam Focus Points
- Definition of port mirroring – Copying traffic from one port to another for analysis.
- Use cases – Troubleshooting, monitoring, and security.
- Components – Source port, destination port, monitoring device.
- Direction – Ingress, egress, or both.
- Tools used with port mirroring – Packet analyzers (Wireshark), IDS/IPS systems.
- Limitations – CPU load, switch support, partial network visibility.
Example Scenario for the Exam
Question:
Your network administrator wants to monitor traffic from a critical server to troubleshoot slow application performance. Which network monitoring method should be used?
Answer:
Port mirroring – Configure the switch to mirror the server’s port to a monitoring device running a packet analyzer.
Port mirroring is a very practical and widely used method in IT environments. Remember, the key exam concept is that it duplicates traffic for monitoring without affecting the original network flow.
