Port mirror client_ip perseverance

Elastic Stack Beats
1

Hi,

If, i do port mirroring and then dump logs to packetbeat. Will i, be able to preserbe the client_ip of the mirrored port.

Wanted to know about the outcome before trying it on my own.

2

Since you are receiving a copy of the packets when using a port mirror, the packets will their original client_ip and ip (and all other data). If your mirror port includes any VLAN encapsulation in the packets then make sure to set with_vlan: true in your interfaces configuration.

3

Thanks a lot @andrewkroh