Traffic Trace Artifacts due to Monitoring Via Port Mirroring

Port-mirroring techniques are supported by many of today's medium and high-end Ethernet switches. The ubiquity and low-cost of port mirroring has made it a popular method for collecting packet traces. Despite its wide-spread use little work has been reported on the impacts of this monitoring method upon the measured network traffic. In particular, we focus upon each of delay and jitter (tinting difference), packet-reordering, and packet-loss statistics. We compare the port-mirroring method with inserting a passive TAP (test access point), such as a fibre splitter, into a monitored link. Despite a passive TAP being transparent to monitored traffic, port-mirroring popularity arises from its limited set-up disruption, and (potentially) easier management This paper documents experimental comparison of traffic using the passive TAP and port-mirroring functionality, and shows that port-mirroring will introduce significant changes to the inter-packet timing, packet-reordering, and packet-loss - even at very low levels of utilisation.