Tools

What this chapter covers

The Tools chapter is about seeing what happens on a switched network, so you can find and fix faults.

The syllabus names port mirroring, and it groups it under Layer 2 diagnostic tools. This guide covers mirroring on one page, and the other RouterOS tools that help with Layer 2 faults on a second page.

Together they give you a path from a simple check to a full packet capture.

After this chapter you should be able to do the following:

• Define mirror source, mirror target, ingress and egress.
• Set up a mirror in the switch menu, and name its limits.
• Pick the lightest tool that answers a given question.
• Explain why a software capture can miss hardware switched frames.

How the topics fit together

The tools move from light to heavy.

The first checks are cheap and quick. A mirror or a capture gives the most detail, but it needs more preparation. Use the lightest tool that answers your question.

The two pages are linked by one fact: the CPU and the switch chip see different traffic. A software tool sees only what the CPU handles. A mirror made by the chip sees what crosses the port, even if the CPU never does.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

• What it is: the idea in plain words.
• How it works: the mechanism, with diagrams and example commands.
• What to remember for the exam: the facts to memorise.
• Common mistakes: the classic traps.
• Check yourself: three questions to test your understanding.

Read the mirroring page first, because it explains the terms source, target, ingress and egress. Then practise the tools on a lab: cause a loop on purpose and watch the host table, create errors with a mismatched duplex and read the counters, and capture traffic with the sniffer.