Port mirror client_ip perseverance


(Rachit Puri) #1

Hi,

If, i do port mirroring and then dump logs to packetbeat. Will i, be able to preserbe the client_ip of the mirrored port.

Wanted to know about the outcome before trying it on my own.


(Andrew Kroh) #2

Since you are receiving a copy of the packets when using a port mirror, the packets will their original client_ip and ip (and all other data). If your mirror port includes any VLAN encapsulation in the packets then make sure to set with_vlan: true in your interfaces configuration.


(Rachit Puri) #3

Thanks a lot @andrewkroh


(system) #4