This article explains how to configure port mirroring on MX devices with the help of an example.

For basic port mirroring configuration steps, refer also to  Configuring Port Mirroring on M, T MX, and PTX Series Routers.

Topology

• In the above setup, SSH traffic is being sent from ixia port 10/11 to ixia port 10/12.

• The Spirent port 1/6 is the collector. 

• Interface xe-0/0/1 is mirrored to ge-3/2/6 on the MX960 router.

Example configuration to show port mirroring on an MX device 
Step 1: set chassis fpc 0 port-mirror-instance ingress

labroot@MX480# show interfaces ge-5/0/6  
unit 0 {
    family inet {
        address 10.10.1.1/30;
    }
}

labroot@MX480# show interfaces xe-0/0/2    
unit 0 {
    family inet {
        address 10.10.3.1/30;
    }
}

labroot@jtac-MX960-r005# show interfaces xe-0/0/1 
unit 0 {
    family inet {
        filter {
            input ingress; >>> The direction of filter will mirror only that traffic. 
                               If an outgoing traffic mirror is required, 
        }                      configure filter in output direction.
        address 10.10.3.2/30;
    }
}

labroot@jtac-MX960-r005# show interfaces ge-3/2/4 
unit 0 {
    family inet {
        address 10.10.8.1/30;
    }
}

labroot@jtac-MX960-r005# show interfaces ge-3/2/6 
unit 0 {
    family inet {
        address 10.10.6.2/30;
    }
}

labroot@jtac-MX960-r005# show forwarding-options 
port-mirroring {
    instance {
        ingress {
            input {
                rate 1;
            }
            family inet {
                output {
                    interface ge-3/2/6.0 {
                        next-hop 10.10.6.2;
                    }
                    no-filter-check;
                }
            }
        }
    }
}

labroot@jtac-MX960-r005# show firewall     
family inet {
    filter ingress {
        term 1 {
            from {
                source-address {
                    10.10.1.2/32;
                }
                destination-address {
                    10.10.9.2/32;
                }
                destination-port ssh;
            }
            then {
                port-mirror-instance ingress;
                accept;
            }
        }
        term 2 {
            then accept;
        }
    }
}

Verification

To verify the port mirroring configuration on the MX Series router, use the following: 

labroot@jtac-MX960-r005# run show forwarding-options port-mirroring   
Instance Name: ingress                       
  Instance Id: 4             
  Input parameters:
    Rate                  : 1
    Run-length            : 0
    Maximum-packet-length : 0
  Output parameters:
    Family              State     Destination          Next-hop
    inet                up        ge-3/2/6.0           10.10.6.1           

Capturing packets on the Spirent port will show the packets that are being input to xe-0/0/1.

2025-11-17: Minor, non-technical modifications to search optimize content

2023-04-11: Added missing step in Solution

2022-02-25: In the solution, added comments in blue for clarity.

2020-08-19: Modified article and topology to make it compliant to standards; article checked for accuracy

2020-07-10: Modified and removed outbound filter configuration in Solution section