Port mirror client_ip perseverance

(Rachit Puri) #1


If, i do port mirroring and then dump logs to packetbeat. Will i, be able to preserbe the client_ip of the mirrored port.

Wanted to know about the outcome before trying it on my own.

(Andrew Kroh) #2

Since you are receiving a copy of the packets when using a port mirror, the packets will their original client_ip and ip (and all other data). If your mirror port includes any VLAN encapsulation in the packets then make sure to set with_vlan: true in your interfaces configuration.

(Rachit Puri) #3

Thanks a lot @andrewkroh

(system) #4