Mirror & SPAN Mode
Monitor an entire network segment from a single SPAN port or network TAP. Deploy one agent on a monitoring server and detect attacks targeting any IP in the segment with independent per-IP baselines.
What Mirror Mode Is
Instead of monitoring the server's own traffic, the agent captures all packets arriving on a designated SPAN/mirror interface and runs per-destination-IP detection. Each IP gets its own baseline, threshold, and attack state.
- Per-IP baselines with independent threshold detection for up to 100,000 IPs
- Protocol breakdown and source IP tracking per destination
- VLAN tag stripping (802.1Q, QinQ) and optional GRE decapsulation
- AF_PACKET with PACKET_FANOUT for multi-thread capture (up to 8 workers)
Setting Up Port Mirroring
Cisco IOS
monitor session 1 source interface GigabitEthernet0/1 - 0/24
monitor session 1 destination interface GigabitEthernet0/48
MikroTik
/interface ethernet switch
set switch1 mirror-source=ether1-ether24 mirror-target=ether48
Linux (tc)
tc qdisc add dev br0 ingress
tc filter add dev br0 parent ffff: protocol all \
u32 match u32 0 0 action mirred egress mirror dev eth1
Agent Configuration
{
"mirror_mode": true,
"mirror_interface": "eth1",
"mirror_subnets": ["10.0.0.0/24"],
"mirror_ip_labels": {"10.0.0.5": "Web Server"},
"mirror_capture_mode": "af_packet"
}
GRE Tunnel Deduplication
For GRE-encapsulated mirrored traffic, enable GRE stripping:
"gre_mode": "enabled", "gre_max_depth": 3
Capture Backends
| Backend | Platform | Notes |
|---|---|---|
| af_packet | Linux | Default. Multi-thread PACKET_FANOUT, up to 8 workers, 8 MB buffer per worker. |
| tcpdump | Any | Fallback. Shells out to tcpdump, parses binary pcap. Auto-fallback if AF_PACKET unavailable. |
Performance
- Per-IP tracking capped at 100,000 destination IPs and 5,000 source IPs per destination
- Use
mirror_subnetsto restrict monitoring on large segments - 1,000 packet size samples per IP per window
ESC