GS316EP: Port mirroring fails to capture traffic between two ports isolated in their own VLAN

wiredfence wrote:

Port 16. Port 16 is a tagged member of both VLAN 1 and VLAN 10.

You can't do that - the mirroring designation port must provide exact the mirrored port data - so the port where you collect all data mirrored in captive mode must never use any other purpose. 

wiredfence wrote:

Has anyone successfully mirrored traffic on a similarly isolated VLAN segment on this or a similar NETGEAR model?

That isn't possible on typical small switches with port mirroring only.

Not aware any industry standard software does allow to operate port mirrring adata toghether with actiove production data.

You want to emulate the SPAN port possibilities you might know from the "big boys" e.g. on Cisco enterprise switches, where you can tunnel SPAN data through a dedicated, independant (SPAN) data channel.

Local SPAN:

Copies traffic between ports on the exact same switch.

Remote SPAN (RSPAN):

Sends mirrored data across a dedicated VLAN to a different switch.

Encapsulated Remote SPAN (ERSPAN):

Tunnels mirrored data across Layer 3 IP networks to reach central analysis tools.

Most common aplications require the SPAN (mirrior port) data on a dedicated port, not carrying any addditional prfoducion or other data on top, typical examples are:

Network Troubleshooting:

Engineers use tools like Wireshark on the destination port to inspect live packet flows, pinpoint latency causes, and diagnose dropped connections. 

Security Monitoring:

Intrusion Detection Systems (IDS) and security platforms read mirrored feeds to spot malware signatures, scanning behavior, and unauthorized access attempts.

Application Performance Management (APM):

IT teams analyze transaction times and user data streams to ensure software applications run fast and reliably.

Compliance and Forensics:

Auditors record and review data streams to verify that systems follow data privacy rules or to investigate past network breaches.