Configuring a Tap Port on MHO-200

Overview

A tap port is a dedicated port used to copy traffic passively from another Orchestrator port for observation - without disturbing whatever is already happening on the source port. It functions like a network wiretap: traffic flowing through a monitored port is duplicated and sent out the tap port, where it can be captured by an external analyser or locally using the m_tcpdump command.

Warning:

Tap ports are intended for short troubleshooting sessions, not continuous monitoring. Always remove tap entries when you complete your troubleshooting. Traffic mirroring consumes resources, and copying production traffic to an untrusted destination is a security risk.

When to use a tap port:

A connection is misbehaving and you want to see exactly what is on the wire.
You need to capture egress traffic (what a port is sending out), not just ingress traffic.
You want to observe a live production port without reconfiguring it.
You want to combine traffic from multiple ports (for example, subordinate interfaces of a bond) into a single capture.

How tap ports work:

A tap port has two ends: one inside the Orchestrator (where mirroring happens) and one physical connector on the front panel.

Something must be connected to the physical connector for captures to work.

If nothing is plugged into the tap port, mirrored traffic disappears, and the m_tcpdump command shows zero packets. Before debugging anything, verify the physical connection.

What you connect depends on your use case:


Use Case	What to Connect
Watch traffic arriving directly at the tap port.	The device whose traffic you want to observe, connected directly.
Mirror another port and capture on an external tool.	A trusted external analyser (Wireshark host, Ixia, etc.).
Mirror another port and capture locally on the Orchestrator.	A fiber loopback connector - wires the port's transmitted traffic (TX) back into its own received traffic (RX), so mirrored traffic is received back by the Orchestrator.

Configuring a Tap Port

Choose an Orchestrator port that is not carrying production traffic.
Get the current port type and write it down:
```
show maestro port <Port Name> site <Site ID> type
```
Example:

show maestro port 1/26/1 site 1 type

Output: downlink
Configure the port type as tap:
```
set maestro port <Port Name> site <Site ID> type tap
```
Example:

set maestro port 1/26/1 site 1 type tap
Add the relevant tap entries (tap rules).

A tap entry is a mirroring rule of the form "copy traffic in the direction X, from port Y, to the tap port Y".
```
add maestro tap-entry site <Site ID> port <Port Name> direction {ingress | egress} tap-port <Port Name>
```
Orchestrator asks you to confirm.

Examples:
- Mirror ingress traffic from port 1/20/1 to the tap port 1/26/1:
  
  add maestro tap-entry site 1 port 1/20/1 direction ingress tap-port 1/26/1
- Mirror egress traffic from port 1/20/1 to the tap port 1/26/1:
  
  add maestro tap-entry site 1 port 1/20/1 direction egress tap-port 1/26/1
Note:
- <Port Name> consists of three numbers separated with the forward slash character:
  
  <Orchestrator ID>/<Port Label on Front Panel>/<Port Split ID>.
- The command add maestro tap-entry creates a new interface with this name (the same three numbers separate with the minus character):
  
  tap<Orchestrator ID>-<Port Label on Front Panel>-<Port Split ID>
  
  Example:
  
  The command
  
  add maestro tap-entry ... tap-port 1/26/1
  
  creates the interface tap1-26-1
- To mirror traffic in both directions, add two tap entries - one for ingress and one for egress.

Verify the active tap entries:

show maestro tap-entries

Example output with two entries mirroring both directions:

Tap Entries:

   MHO    Port to Tap    Direction    Tap Port
 ────────────────────────────────────────────
   1_1    1/20/1         ingress      1/26/1
   1_1    1/20/1         egress       1/26/1

Capture the mirrored traffic using one of these options.
- Option A - Local capture on the Orchestrator (loopback connector is required):
  
  Use the m_tcpdump command (see Traffic Capture on MHO-200 - m_tcpdump):
```
m_tcpdump -i tap<Orchestrator ID>-<Port ID>-<Split ID> <options>
```
  Example:
  
  m_tcpdump -i tap1-26-1 <options>
  
  Warning:
  Local traffic captures consume CPU. Keep them short, filtered, and avoid running them during high-traffic periods.
- Option B - External analyser:
  
  Connect a Wireshark host, Ixia, or equivalent analyser to the tap port.
  
  Traffic will arrive at the analyser in real time - capture using the analyser's own tooling.
Remove all tap entries:
```
delete maestro tap-entry site <Site ID> port <Port Name> direction {ingress | egress} tap-port <Port Name>
```
Examples:
- Mirror ingress traffic from port 1/20/1 to tap port 1/26/1:
  
  delete maestro tap-entry site 1 port 1/20/1 direction ingress tap-port 1/26/1
- Mirror egress traffic from port 1/20/1 to tap port 1/26/1:
  
  delete maestro tap-entry site 1 port 1/20/1 direction egress tap-port 1/26/1
Verify there are no remaining tap entries:
```
show maestro tap-entries
```
Configure the port type to its original type:
```
set maestro port <Port ID> site <Site ID> type <Original Type>
```
Example:

set maestro port 1/26/1 site 1 type downlink