I would like to clarify few things in this blog entry about the Port-mirroring feature that is available on vSphere Distributed Switch (VDS). This feature is similar to the port mirroring capability available on the physical switches. Network administrators can use this feature to troubleshoot any network related issues in the virtual infrastructure and monitor virtual machine to virtual machine traffic that is flowing on the same ESXi host. Network administrators use network analyzer tool, which captures traffic, along with the port mirror feature to perform monitoring and troubleshooting activities. In the physical network, depending on where the analyzer or debug tool is placed in the network, network administrators choose different port mirroring options. The following are some of the standard port mirroring options available on physical switches:
- Switch Port Analyzer (SPAN)
- Remote Switch Port Analyzer (RSPAN)
- Encapsulated Remote Switch Port Analyzer (ERSPAN)
SPAN feature is local to the switch and requires the monitored ports and the destination port are on the same switch. With the release of vSphere 5.0, VMware provides support for only SPAN feature on VDS. The following blog entry<http://blogs.vmware.com/networking/2011/08/vsphere-5-new-networking-features-port-mirroring.html> discusses the feature in little more detail. During the setup of a SPAN session customers have to select a virtual port that needs monitoring and then choose a destination virtual port where all the traffic will be mirrored. Here are some of the common monitoring and troubleshooting use cases based on where the analyzer tool is running.
1) Mirroring to an analyzer tool running in a virtual machine on the same host.
As shown in the figure below, you can have a virtual machine run analyzer tool. In such scenario you have to configure the pot mirror session with source as virtual port of the monitored virtual machine and destination as the virtual port of the virtual machine running analyzer tool.
[http://blogs.vmware.com/.a/6a00d8341c328153ef017742b7115c970d-500wi]<http://blogs.vmware.com/.a/6a00d8341c328153ef017742b7115c970d-pi>
2) Mirroring to an external physical analyzer connected directly to the uplink port of the host.
In this case the analyzer tool is running on an external physical device, which is directly connected to the host through a NIC. As shown in the figure below, the source virtual port of the port mirror session remains same but the destination is changed to the uplink port connected to vmnic1. The mirror packets are sent through the vmnic1 to the analyzer device for monitoring.
[http://blogs.vmware.com/.a/6a00d8341c328153ef017742b71202970d-500wi]<http://blogs.vmware.com/.a/6a00d8341c328153ef017742b71202970d-pi>
3) Mirroring to an external physical analyzer connected to a physical switch where the host is also connected.
This setup is possible provided you configure a SPAN session on the VDS and physical switch as well. Let's dig a little more here. As mentioned earlier, SPAN feature is local to a switch and requires both monitored and destination ports on the same switch. If you look at the diagram below, the analyzer is not directly connected to the VDS. It is connected through a physical switch. So this is not a straightforward use case 2.
Let's take a look at the mirror packet flow. The port mirror session is configured on the VDS with the virtual port of the monitored virtual machine as the source and uplink connected to vmnic 1 as the destination. All packets flowing through the monitored virtual machine are now copied through the vmnic1 to the physical switch port. On the same physical switch the analyzer is connected to a different port. The analyzer connected to a port on the same switch is not going to see the traffic mirrored by VDS. For this use case to work, it is not enough to configure the port mirror session on VDS. You have to configure SPAN session on the physical switch with the switch port where the host's vmnic 1 is connected is the monitored port and the destination port is where the analyzer is connected.
[http://blogs.vmware.com/.a/6a00d8341c328153ef017615d155a1970c-500wi]<http://blogs.vmware.com/.a/6a00d8341c328153ef017615d155a1970c-pi>
VDS currently doesn't support RSPAN capability, which allows network administrators to monitor the traffic remotely multiple hops away from the source. Customers have to create a dedicated VLAN to carry the RSPAN traffic and the switches supporting RSPAN feature have to encapsulate all the monitored traffic in this special VLAN.
There is also some confusion because of the GUI screen options provided during the port mirroring setup on VDS.
If you take a look at the configuration screen shown below, there is an encapsulation option shown in the red box. This encapsulation option gives the feeling that RSPAN is supported. However, it is not and you shouldn't configure this parameter.
[http://blogs.vmware.com/.a/6a00d8341c328153ef016767dc0cc3970b-500wi]<http://blogs.vmware.com/.a/6a00d8341c328153ef016767dc0cc3970b-pi>
________________________________
Original Page: http://blogs.vmware.com/vsphere/2012/06/how-to-use-port-mirroring-feature-of-vds-for-monitoring-virtual-machine-traffic.html
No comments:
Post a Comment