How to Setup SPAN Port Monitoring

Sinefa Probes can accept raw packets from a router or switch using SPAN or Port Mirroring.  

The Sinefa Probe requires two (2) network interfaces (ports) so that monitoring mode can be enabled, 1 for management and 1 to accept the SPAN/Port Mirror traffic.

Warning for Sinefa Hardware Probe
Do NOT plug the management port and SPAN port into the same bridge pair.

Guide Summary

Each of these sections will need to be completed to get the probe up and running

Setting up the network connections
Configuring Local Subnets to specify inbound/outbound direction

Step 1: Network cabling / connections: 

For Virtual and Software Probes

Port 1: Management Port
Port 2: SPAN Port (receives Outbound and Inbound Packets)

For SF801 (hardware probe)

lan1 (br1): Management Port
wan2 (br2): SPAN Port (receives Outbound and Inbound Packets)

For SF150 (hardware probe)

mgmt : Management Port
wan1 (br1): SPAN Port (receives Outbound and Inbound Packets)

Step 2: Configure Subnets for inbound / outbound direction

1. From the Sinefa App setup your Local Subnets so that the Sinefa system knows which traffic is inbound and outbound.
2. Go to Settings -> Probes. Edit the settings of the Probe and input the Local Subnets. e.g. the local LAN subnet may be 192.168.12.0/24. You can enter more than 1 subnet, seperate them with commas. Then press Apply.
   
3. Now, configure your router/switch to mirror all packets to/from the router to the Sinefa SPAN Port.
4. Next, go to Settings -> Utilization. Edit the Primary Source by clicking on the pencil icon next to it and check the 'Use Subnets' option. This instructs the probe to use the LAN subnets defined in the previous step to determine packet direction.
   
   Please note: Collection Direction is to be set to External unless you have connected your SPAN port to the LAN interface on the probe, which in that case would be required to be set to Internal
5. It may take up to 5 mins after monitoring SPAN traffic for the source to appear in the "Primary Sources" table.

See Also
How to configure SPAN or Port Mirroring on a Cisco Router or Switch
Sinefa Best Practice Guide