Scenario:
Make: Ubiquiti
Model: Ubiquiti UniFi Switches [USW Lite, USW Standard, USW Pro, USW Enterprise; 8, 16, 24 and 48 ports; PoE, PoE+ and non-PoE]
Mode: GUI [Graphical User Interface]
Version: UniFi Network Controller 5.x (screenshots) and the newer UniFi Network application
Description: In this article, we will discuss a step-by-step method to configure SPAN or port mirroring on Ubiquiti UniFi switches, including how source and destination ports work, how to verify the mirror with Wireshark, and common issues. Note that this applies to UniFi switches (USW models), not the USG security gateway.
What Is Port Mirroring (SPAN)?
Port mirroring, also known as SPAN (Switched Port Analyzer), copies the traffic of one switch port to another port. A monitoring device, such as a laptop running Wireshark or an IDS appliance, is connected to that second port to analyze the traffic without interrupting the network.
Two terms are important before you start:
- Source port (mirrored port) – the port whose traffic you want to monitor, for example the uplink to your router or firewall.
- Destination port (mirroring port) – the port where you connect the monitoring device. On UniFi switches, this is the port you configure.
Before You Start
- Choose a free port as the destination. Once mirroring is enabled, the destination port stops carrying normal network traffic, so do not use a port that a device depends on.
- Match the port speeds. The destination port should be the same speed as, or faster than, the source port. Otherwise, mirrored packets may be dropped on a busy link.
- Prepare the monitoring device, such as a laptop with Wireshark installed.
Configuration Steps
Step 1: Log In to the UniFi Controller
Log in to the UniFi Network controller with your username and password. If the controller has not been set up yet, see Ubiquiti UniFi Default Username and Password.
Step 2: Open Devices
Navigate to Devices to see the list of UniFi switches, access points and gateways.
Step 3: Select the Destination Port
Select the switch and open the port where you will connect the monitoring device. This port will become the destination (mirroring) port.
Step 4: Enable Mirroring on the Port
In the 5.x controller, click Edit on the port and open Profile Overrides, then:
- Change the port operation from Switching (the default) to Mirroring.
- Select the source port you want to monitor, for example the uplink to your router, firewall or another switch.
- Set the link speed if needed. Autonegotiate works in most cases.
- Click Apply to save the changes.
Newer UniFi Network application: Go to UniFi Devices, select the switch and open Port Manager. Select the destination port, change its operation to Mirroring, choose the source port to mirror, and click Apply Changes. Menu names can differ slightly between versions, but the options are the same.
Step 5: Verify the Mirror with Wireshark
Connect your laptop to the destination port, open Wireshark and start a capture on the laptop’s wired network adapter. You should see traffic between other devices on the network, not just your laptop’s own traffic. If you do, port mirroring is working.
Important Note: When you finish monitoring, set the destination port back to Switching. Otherwise, the port will stay unusable for normal devices.
Troubleshooting
- Wireshark shows only your own traffic – the wrong port was set as the source, or the laptop is connected to a different port than the one configured as the destination.
- The laptop has no network access – this is expected. The destination port only receives copied traffic and does not provide normal connectivity.
- Packets are missing in the capture – the source port is busier than the destination port can handle. Use a destination port with the same or higher speed.
- The Mirroring option is missing or greyed out – check that the switch firmware and controller are up to date, and that the port is not part of a link aggregation (LAG) group.
Frequently Asked Questions
Can I configure port mirroring on the UniFi USG?
Port mirroring is a switch feature. To monitor traffic passing through a USG or other UniFi gateway, mirror the switch port that connects to the gateway’s LAN port.
Does port mirroring affect network performance?
It does not affect traffic on the source port. Only the destination port is taken out of normal use while mirroring is enabled.
How many ports can I mirror at once?
This depends on the switch model and firmware. Many UniFi switches support a single mirroring session, so check your model’s documentation if you need to monitor several ports.
Port mirroring can be configured on other vendors as well; see SPAN or Port Mirroring On Dell or Cisco Switches. If you manage a UniFi controller, you may also want to install an SSL certificate on the UniFi controller, which starts with generating a CSR on Ubiquiti.
Disclaimer: This article is for educational purposes only and is not professional financial, medical, or legal advice. It may contain affiliate links, which earn us a small commission at no extra cost to you. See our Disclaimer and Affiliate Disclosure.
Article ID: EA00084