3 Figure 2: Protocol analysis in Switched Ethernet: Only parts of data communication can be recorded. Monitor ports and probes To circumvent the problem switches are offered which support the so-called mirror-port function. With port mirroring the data packets of a source port are mirrored or copied on a target port (i.e., the mirror port). If the
protocol analyzer is connected to the target port, the analyzer can then monitor the data communication of the source port. Several ports can also be mirrored on the mirror port depending on the manufacturer of the switch. One should naturally be careful to ensure that the mirror port can handle the amount of data of the mirrored port. If that is not the case, packets will be lost. However, people who are very familiar with their network and its load will also be able to use the mirror port function for several source ports. >