We are seeing traffic discrepancy when remote port-mirror is configured, when switched to local port-mirror we do not see traffic discrepancy.
The configuration that is working is the following
Local port-mirror
set interfaces xe-0/1/4:0 speed 10g
set interfaces xe-0/1/4:0 unit 0 family inet address 192.168.200.0/31 arp 192.168.200.1 mac 11:22:33:44:55:66
set forwarding-options port-mirroring input rate 1
set forwarding-options port-mirroring input maximum-packet-length 256
set forwarding-options port-mirroring family inet output interface xe-0/1/4:0.0 next-hop 192.168.200.1
set firewall family inet filter INBOUND_IPV4 term 1-MIRROR then count Mirror-Allowed
set firewall family inet filter INBOUND_IPV4 term 1-MIRROR then port-mirror
Below the topology we are using
We are sending 14000000 pps from Ixia 1 to Ixia 2.
We can see that 14000000 pss are mirrored towards the collector.
user@router> monitor interface traffic
et-0/0/4 Up 94202166206 (14005180) 280535277 (0)
et-0/0/6 Up 280515736 (0) 94202307018 (14001944)
et-0/0/8 Down 0 (0) 0 (0)
et-0/0/9 Down 0 (0) 0 (0)
et-0/0/10 Down 0 (0) 0 (0)
et-0/0/11 Down 0 (0) 0 (0)
et-0/1/0 Down 0 (0) 0 (0)
et-0/1/1 Down 0 (0) 0 (0)
et-0/1/2 Down 0 (0) 0 (0)
et-0/1/3 Down 0 (0) 0 (0)
et-0/1/4:0 Up 42651 (0) 30146727741 (14000127)
------------------------------------------------------------------------------------------------------------------------------------------------------------
The configuration that is not working as expected is the following
Remote port mirror
set interfaces fti0 unit 0 tunnel encapsulation gre source address 167.207.164.168
set interfaces fti0 unit 0 tunnel encapsulation gre destination address 192.168.200.1
set interfaces fti0 unit 0 family inet
set forwarding-options port-mirroring instance TEST-mirror-instance input rate 1
set forwarding-options port-mirroring instance TEST-mirror-instance input maximum-packet-length 256
set forwarding-options port-mirroring instance TEST-mirror-instance family inet output interface fti0.0
set firewall family inet filter INBOUND_IPV4 term 1-MIRROR then port-mirror-instance TEST-mirror-instance
We are using the same topology
We can see that only 11577720 pss are mirrored towards the collector.
et-0/0/4 Up 102643681476 (14007055) 280535299 (0)
et-0/0/6 Up 280515737 (0) 102643824042 (14007158)
et-0/1/4:0 Up 42727 (0) 37791529591 (11578608)
Does the rate matter?
First, we need to mention that the closest we are to 1:1 rate the closest we are to experiment congestion in the router.
1:1 rate is usually configured while we are doing troubleshooting in the router but it should be removed later.
We used rate 1:1 in this configuration because it is a lab set up and because it was the easiest way to demonstrate the traffic discrepancy.
Is there an optimal number rate to increase performance/accrucy?
If you are sending mirrored traffic constantly towards a collector, please configure input rate 10000, rates below 10000 are too aggressive for remote port-mirror.
how much degradation is consider normal?
It depends on different factors, for example the amount of traffic you are trying to mirror and the internal traffic that traverses the same path at the moment of mirror traffic, ideally we should not see any degradation, but if all traffic is sharing the same resource at the same time then port mirror traffic will be discarded first.
Below Architectural Differences between how the traffic is treated.
Local Port Mirroring
Remote Port Mirroring
This reinjection step introduces large amounts of additional processing and bandwidth usage.
-----------------
Summary
Remote port mirroring inherently requires additional internal processing and recirculation bandwidth, which creates contention with other features on the 400 Gbps internal link.
Under high sampling rates, this results in performance degradation and packet drops. In contrast, local mirroring avoids these bottlenecks entirely due to its direct forwarding path.
So we would suggest to look at sampling rate so that, system is operating within its constraints.