Port mirroring

When port mirroring is enabled, the TOR switch sends a copy of the network packet from the mirrored ports to the monitor port. This feature is typically used for monitoring and intrusion detection.

Port mirroring is used on a network switch to send a copy of network packets seen on one switch port (or an entire VLAN) to a network monitoring connection on another switch port. This is commonly used to send traffic to applications that analyze traffic for purposes such as monitoring compliance, enforcing policies, detecting intrusions, and so on.

Network engineers or administrators use port mirroring to analyze and debug data or diagnose errors on a network. It helps administrators keep a close eye on network performance and alerts them when problems occur. It can be used to mirror either inbound or outbound traffic (or both) on single or multiple interfaces.

You can mirror data ports on the TOR switch but not internal ports. The traffic setting when you enable this feature tells the system which direction to monitor.