New Feature Ready for Review: VLAN Support

[cn187]

One of the advantages of the implementation I proposed is that in theory I can combine multiple port mirrors into my single destination port, so I could have multiple different VLANs of mirrored traffic hitting my showeq's dedicated mirror NIC, and I could sniff eq sessions on any of them.

That's a really nice capability for multi-boxers on TrueBox servers, or households with multiple players and a dedicated showeq box.

As far as testing, I created an offline packet capture and then replayed it while I was doing my testing. I would share it but I'm not sure of the privacy of the eq packets in my capture.

The capture will have all kinds of identifying info in it, so you definitely don't want to post it publicly. Thinking about it a little more, I probably can't reproduce your exact scenario, but I should be able to do a capture directly on my switch (since the I can see the tags there) and then use that pcap for playback, which should be good enough.

[mystery]

That's a really nice capability for multi-boxers on TrueBox servers, or households with multiple players and a dedicated showeq box.

Yeah that's exactly what I was thinking. There's one edge case that I guess would still exist, where if you somehow used multiple different VLANs and then allowed the same IP addressing on each (like two diff vlans but they both had same IP). At that point you would need to instead preserve the VLAN information, or pass it further into the stack so that they could be categorized separately in the UI, but I don't forsee that situation being likely even with my weird edge case (all my boxes are on the same VLAN already).

The capture will have all kinds of identifying info in it, so you definitely don't want to post it publicly. Thinking about it a little more, I probably can't reproduce your exact scenario, but I should be able to do a capture directly on my switch (since the I can see the tags there) and then use that pcap for playback, which should be good enough.

If you're just looking to get some traffic with 802.1q tags, and your switch supports TRUNK or GENERAL mode, you might be able to add an additional VLAN to the switch port and it will keep that traffic tagged (since trunked VLAN traffic stays tagged, or any VLAN beyond the first one on a GENERAL port, which seems to combine TRUNK and ACCESS). You probably already know all this, but just in case it helps!

[xerxes]

One of the advantages of the implementation I proposed is that in theory I can combine multiple port mirrors into my single destination port, so I could have multiple different VLANs of mirrored traffic hitting my showeq's dedicated mirror NIC, and I could sniff eq sessions on any of them.

That's a really nice capability for multi-boxers on TrueBox servers, or households with multiple players and a dedicated showeq box.

I've been wondering about how much extra load the port mirroring puts on the network. I multibox on multiple machines and the way I ended up giving the same functionality is that the secondary switch that's connected to the machines running EQ are mirroring their traffic to the switch port that is connected to another switch with the showEQ box on it. Since the port being mirrored contains all of the traffic from the other switch, I am able to easily swap between which machine it is monitoring. But I think by doing this, it's also creating a ton of additional, unnecessary traffic on the network, both when EQ is running and when it is not.

[cn187]

I've been wondering about how much extra load the port mirroring puts on the network. I multibox on multiple machines and the way I ended up giving the same functionality is that the secondary switch that's connected to the machines running EQ are mirroring their traffic to the switch port that is connected to another switch with the showEQ box on it. Since the port being mirrored contains all of the traffic from the other switch, I am able to easily swap between which machine it is monitoring. But I think by doing this, it's also creating a ton of additional, unnecessary traffic on the network, both when EQ is running and when it is not.

To clarify - You have the EQ client switch mirroring multiple ports to a singe port, then you're connecting that mirrored port to the SEQ switch. But then on the SEQ switch, you have that port mirrored again to the SEQ box's port?