# Port mirror client\_ip perseverance

**URL:** https://discuss.elastic.co/t/port-mirror-client-ip-perseverance/47923
**Category:** Beats
**Tags:** packetbeat
**Created:** [April 20, 2016, 2:41pm UTC](https://discuss.elastic.co/t/port-mirror-client-ip-perseverance/47923 "2016-04-20T14:41:51Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Rachit\_Puri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rachit_puri/32/5721_2.png) [@Rachit\_Puri](https://discuss.elastic.co/u/Rachit_Puri)
#### Post date: [April 20, 2016, 2:41pm UTC](https://discuss.elastic.co/t/port-mirror-client-ip-perseverance/47923/1 "2016-04-20T14:41:51Z")

</div>

Hi,

If, i do port mirroring and then dump logs to packetbeat. Will i, be able to preserbe the client\_ip of the mirrored port.

Wanted to know about the outcome before trying it on my own.

---

<div class="post-metadata">

### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [April 20, 2016, 2:48pm UTC](https://discuss.elastic.co/t/port-mirror-client-ip-perseverance/47923/2 "2016-04-20T14:48:28Z")

</div>

Since you are receiving a copy of the packets when using a port mirror, the packets will their original `client_ip` and `ip` (and all other data). If your mirror port includes any VLAN encapsulation in the packets then make sure to set `with_vlan: true` in your interfaces configuration.

---

<div class="post-metadata">

### Author: ![Rachit\_Puri](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rachit_puri/32/5721_2.png) [@Rachit\_Puri](https://discuss.elastic.co/u/Rachit_Puri)
#### Post date: [April 21, 2016, 5:21am UTC](https://discuss.elastic.co/t/port-mirror-client-ip-perseverance/47923/3 "2016-04-21T05:21:28Z")

</div>

Thanks a lot @andrewkroh

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 5, 2017, 9:52pm UTC](https://discuss.elastic.co/t/port-mirror-client-ip-perseverance/47923/4 "2017-07-05T21:52:57Z")

</div>


