Overview
RM Mirror (Remote Mirror) is a port mirroring method that copies traffic from a source port on one switch and delivers it — through a dedicated mirror VLAN across intermediate switches — to a destination port on a remote switch, where a monitoring laptop can capture and analyse the traffic. Unlike local port mirroring (SPAN), which requires the monitoring laptop to be physically connected to the same switch as the source port, RM Mirror allows engineers to perform packet capture from anywhere in the network. ORing managed switches ([PRODUCT_MODELS]) support RM Mirror, equivalent to RSPAN (Remote Switched Port ANalyzer) in Cisco terminology. This guide configures RM Mirror across three switches using VLAN 200 as the dedicated mirror VLAN.
Prerequisites
- Applicable models: ORing managed switches ([PRODUCT_MODELS])
- Minimum firmware: [FIRMWARE_VERSION]
- Login level required: Administrator
- Three switches interconnected as shown in the topology below
- VLAN 200 (or any unused VLAN ID) reserved exclusively for RM Mirror — must not overlap with production VLANs
- Monitoring laptop with Wireshark or equivalent packet capture software
RM Mirror port role definitions
| Role | Function | This example | MAC Learning | Special requirement |
|---|---|---|---|---|
| Source Port | Port whose traffic is being monitored (copied) | Switch 1, Port 4 | Normal (enabled) | Set mode = Both (Tx + Rx) |
| Reflector Port | Internal buffer port that re-tags mirrored frames with mirror VLAN ID | Switch 1, Port 2 | Must be DISABLED | ⚠️ Do NOT connect a cable |
| Intermediate Port | Uplink/downlink port that forwards mirror VLAN traffic between switches | Switch 1 Port 1, Switch 2 Port 1 & 2, Switch 3 Port 1 | Must be DISABLED | Enable Intermediate mode |
| Destination Port | Port where monitoring laptop connects to receive mirrored traffic | Switch 3, Port 4 | Normal (enabled) | Connect laptop / Wireshark here |
Test topology
| Switch | Port | Role | Connected to | Mirror mode setting |
|---|---|---|---|---|
| Switch 1 | Port 4 | Source Port | Monitored device | Both (Tx + Rx) |
| Switch 1 | Port 2 | Reflector Port | Not connected ⚠️ | Reflector |
| Switch 1 | Port 1 | Intermediate Port | Switch 2 Port 1 | Intermediate |
| Switch 2 | Port 1 | Intermediate Port | Switch 1 Port 1 | Intermediate |
| Switch 2 | Port 2 | Intermediate Port | Switch 3 Port 1 | Intermediate |
| Switch 3 | Port 1 | Intermediate Port | Switch 2 Port 2 | Intermediate |
| Switch 3 | Port 4 | Destination Port | Monitoring laptop | Destination |
Part 1 — Configure Switch 1 (Source switch)
Switch 1 contains the source port being monitored (Port 4), the Reflector Port (Port 2), and the Intermediate Port (Port 1) that forwards mirrored traffic toward Switch 2. Three settings must be configured: port mirror roles, MAC Learning disable, and mirror VLAN assignment.
Step 1 — Set port mirror roles on Switch 1
Navigate to [MENU_PATH_MIRROR] on Switch 1 and configure the following ports:
- Port 4 (Source Port) — set Source mode to Both, which mirrors all Tx (transmit) and Rx (receive) traffic from this port
- Port 1 (Intermediate Port) — enable Intermediate mode only; this port forwards mirrored traffic to Switch 2
- Port 2 (Reflector Port) — set as Reflector; this port re-tags mirrored frames with the mirror VLAN ID
⚠️ WARNING — Reflector Port (Port 2): Do NOT connect a network cable to the Reflector Port. This port is used internally for packet buffering and re-tagging only. Its link LED will light up during operation — this is normal behaviour. Connecting a cable to the Reflector Port will cause a network loop or traffic anomaly on the production network.
Step 2 — Disable MAC Learning on Switch 1 Intermediate and Reflector Ports
Navigate to [MENU_PATH_MAC] on Switch 1. Disable MAC Learning on:
- Port 1 (Intermediate Port)
- Port 2 (Reflector Port)
MAC Learning must be disabled on these ports because RM Mirror traffic carries the original source MAC addresses of monitored frames. If MAC Learning remains enabled, the switch will incorrectly associate these MAC addresses with the mirror ports and begin forwarding normal production traffic to them — corrupting the forwarding table and potentially disrupting production network communications.
Step 3 — Assign mirror VLAN 200 to Switch 1
Navigate to [MENU_PATH_VLAN] on Switch 1. Assign VLAN 200 as the RM Mirror VLAN ID. All ports participating in RM Mirror across all three switches must be members of this VLAN. VLAN 200 is used in this example — choose any VLAN ID that is not used by production traffic.
All mirrored frames will be tagged with VLAN 200 by the Reflector Port and forwarded through the network. Any switch port that is a member of VLAN 200 will receive the mirrored traffic.
Part 2 — Configure Switch 2 (Intermediate switch)
Switch 2 has no Source or Destination port — its only role is to forward mirrored VLAN 200 traffic between Switch 1 and Switch 3. Both uplink ports must be set to Intermediate mode, have MAC Learning disabled, and be members of VLAN 200.
Step 4 — Set Intermediate Ports, disable MAC Learning, and assign VLAN 200 on Switch 2
Navigate to [MENU_PATH_MIRROR] on Switch 2 and configure:
- Port 1 (toward Switch 1) — enable Intermediate mode
- Port 2 (toward Switch 3) — enable Intermediate mode
Navigate to [MENU_PATH_MAC] on Switch 2 and disable MAC Learning on Port 1 and Port 2.
Navigate to [MENU_PATH_VLAN] on Switch 2. Add Port 1 and Port 2 as members of VLAN 200.
Part 3 — Configure Switch 3 (Destination switch)
Switch 3 receives mirrored traffic from Switch 2 on its Intermediate Port (Port 1) and delivers it to the monitoring laptop via the Destination Port (Port 4). MAC Learning must be disabled on the Intermediate Port only — the Destination Port operates normally.
Step 5 — Set Intermediate and Destination Ports on Switch 3
Navigate to [MENU_PATH_MIRROR] on Switch 3 and configure:
- Port 1 (toward Switch 2) — enable Intermediate mode
- Port 4 (toward monitoring laptop) — set as Destination Port
Navigate to [MENU_PATH_MAC] on Switch 3. Disable MAC Learning on Port 1 (Intermediate Port) only. Port 4 (Destination Port) does not require MAC Learning to be disabled.
Navigate to [MENU_PATH_VLAN] on Switch 3. Add Port 1 to VLAN 200 to receive incoming mirror traffic from Switch 2.
Part 4 — Verify RM Mirror operation
Connect a laptop running Wireshark (or equivalent packet capture software) to Switch 3 Port 4 (Destination Port). Start a packet capture on the laptop's NIC.
Expected result
- Wireshark should display frames originating from the device connected to Switch 1 Port 4 (the source port)
- Both Tx (outgoing) and Rx (incoming) traffic from the source port should be visible, since Source mode was set to Both in Step 1
- The frames will appear with their original source and destination MAC addresses — not the switch MAC addresses
Configuration summary checklist
| Switch | Port | Mirror role | MAC Learning | VLAN 200 |
|---|---|---|---|---|
| Switch 1 | Port 4 | Source (Both) | Enabled | — |
| Switch 1 | Port 2 | Reflector ⚠️ no cable | Disabled | Member |
| Switch 1 | Port 1 | Intermediate | Disabled | Member |
| Switch 2 | Port 1 | Intermediate | Disabled | Member |
| Switch 2 | Port 2 | Intermediate | Disabled | Member |
| Switch 3 | Port 1 | Intermediate | Disabled | Member |
| Switch 3 | Port 4 | Destination | Enabled | — |
Troubleshooting common RM Mirror issues
Destination port not receiving any mirrored traffic
Check in this order: (1) confirm MAC Learning is disabled on all Intermediate Ports and the Reflector Port across all three switches — this is the most common root cause; (2) verify VLAN 200 is assigned to all Intermediate Ports on all three switches; (3) confirm the Reflector Port (Switch 1 Port 2) does not have a cable connected; (4) verify the Source Port mode is set to Both (or the required Tx/Rx direction); (5) check that VLAN 200 is not blocked by any VLAN membership or filtering rules between the switches.
Production network traffic is disrupted after configuring RM Mirror
The most likely cause is a cable connected to the Reflector Port (Switch 1 Port 2). The Reflector Port continuously forwards frames and will cause a network loop if connected to another device. Immediately disconnect the cable from the Reflector Port. If the issue persists, check whether MAC Learning is still enabled on any Intermediate Port — re-learning of mirror traffic MAC addresses can corrupt the production forwarding table.
Only Tx or only Rx traffic appears in Wireshark, not both
Verify the Source Port (Switch 1 Port 4) mirror mode is set to Both. If it is set to Tx only or Rx only, only one direction of traffic will be mirrored. Change the mode to Both and allow 5–10 seconds for the configuration to take effect before recapturing.
Mirrored frames appear in Wireshark but with wrong MAC addresses
If the captured frames show switch MAC addresses instead of original device MAC addresses, MAC Learning may still be enabled on an Intermediate Port. The switch is replacing source MAC addresses in the mirror frames. Disable MAC Learning on all Intermediate and Reflector Ports and restart the packet capture.
Frequently asked questions
What is RM Mirror and how is it different from local port mirroring?
Local port mirroring (SPAN) copies traffic from a source port to a destination port on the same switch. RM Mirror (Remote Mirror, equivalent to RSPAN) extends mirroring across multiple switches via a dedicated VLAN, allowing the monitoring laptop to be physically located on a different switch from the source port. This is essential in large industrial networks where physical access to every switch is not always possible. See ORing managed switch product range for supported models.
What is a Reflector Port and why must I not connect a cable to it?
The Reflector Port re-tags mirrored frames with the RM Mirror VLAN ID before sending them to the Intermediate Port. It operates in a continuous forwarding state internally. Connecting a cable creates a physical loop that will propagate through the network and disrupt production traffic. Always leave the Reflector Port physically disconnected — its LED lighting up is normal and expected.
Why must MAC Learning be disabled on Intermediate and Reflector Ports?
RM Mirror traffic carries the original source MAC addresses of monitored frames. If MAC Learning is enabled on these ports, the switch learns these addresses against the mirror ports and forwards production traffic to them instead of the correct destination — corrupting the forwarding table. Disabling MAC Learning on Intermediate and Reflector Ports prevents this from happening.
Can I use any VLAN ID for the RM Mirror VLAN?
Yes. VLAN 200 is used in this example, but any unused VLAN ID is acceptable. The mirror VLAN must not overlap with any production VLAN, must be created on all three switches, and must be allowed on all Intermediate Ports between the source and destination switches.
Destination port on Switch 3 is not receiving mirrored traffic — what should I check first?
Start with MAC Learning — it must be disabled on all Intermediate Ports (Switch 1 Port 1, Switch 2 Port 1 and Port 2, Switch 3 Port 1) and the Reflector Port (Switch 1 Port 2). Then verify VLAN 200 membership on all Intermediate Ports, confirm no cable is connected to Switch 1 Port 2, and check the Source Port mode is set to Both. See the Troubleshooting section above for the full diagnostic checklist.
