Packet mirroring

1. A network device, comprising:

a network chip including logic and a number of network ports for the device for receiving and transmitting packets therefrom; and

wherein the logic is operable to mirror a packet on a per port per virtual local area network (VLAN) membership basis by selecting ports for a mirror action according to a network port of the network device receiving the packet and a VLAN for the port, and

the logic is operable to identify a mirror index according to the VLAN for the port and use the mirror index to determine whether the mirror action is a mirror-only action or a mirror-steal action and to identify a filter according to the mirror index to apply to the selected ports for the mirror action,

if the mirror action is determined to be a mirror-only action, the logic is operable to apply the filter to the selected ports to select ports for the mirror-only action, and

if the mirror action is determined to be a mirror-steal action, the logic is operable to apply the filter to the selected ports to identify masked ports, wherein the packet is prevented from being sent to the masked ports.

2. The device of claim 1 , wherein the logic can mirror a subset of ports on a VLAN to be mirrored.

3. The device of claim 1 , wherein the logic can mirror packets requesting access to multiple destination ports.

4. The device of claim 1 , wherein the logic can:

mirror-steal packets associated with a given port for packets having membership in a first VLAN; and

mirror packets associated with the given port for packets having membership in a second VLAN such that packets received from the given port realize different mirror actions based on VLAN membership.

5. The device of claim 1 , wherein the logic can mirror packets of both input and output network traffic on the device.

6. The device of claim 1 , wherein the logic accesses a mirror filter table and maps the VLAN to an entry in the mirror filter table to determine the mirror filter index.

7. The device of claim 1 , wherein the logic can mirror packets on a destination port.

8. The device of claim 1 , wherein the logic can:

group a number of ports according to the mirror filter table based on a criteria; and

define an action to steal a packet and remove a port from an access list in addition to setting a mirror bit.

9. The device of claim 8 , wherein the criteria includes at least one criteria selected from the group of:

a physical source port;

a source media access controller address;

a destination media access controller address;

a source IP address;

a destination IP address;

a protocol type;

a source port number;

a destination port number;

an IP flow; and

a port being connected to a wireless network.

10. The device of claim 1 , wherein, when the logic can detect an action bit indicating a steal operation and remove a port from an access list and set a mirror bit.

11. The device of claim 10 , wherein the logic can mirror-steal a packet to a checking functionality on a set mirror bit.

12. The device of claim 11 , wherein the logic mirrors packets to a checking functionality selected from the group of:

an intrusion prevention system;

an intrusion detection system;

a counting device; and

an accounting device.

13. The device of claim 1 , wherein the logic mirrors packets to a checking functionality located in the network in a location selected from the group of:

a location remote to the device;

a location on an ingress network chip of the device;

a location on a network chip different from the ingress network chip, but located on a same plug-in blade of the ingress network chip;

a location on a different plug-in blade from the same plug-in blade of the ingress network chip;

a location for a plug-in appliance which is attached locally to the device; and

a location which is remote from the device.

14. A method performed by logic in a network chip, the method comprising:

selecting ports for a mirror action according to a network port receiving a packet and a VLAN for the port;

identifying a mirror index according to the VLAN for the port;

determining whether the mirror action is a mirror-only action or a mirror-steal action according to the mirror index;

identifying a filter according to the mirror index;

if the mirror action is determined to be a mirror-only action, applying the filter to the selected ports to select ports for the mirror-only action; and

if the mirror action is determined to be a mirror-steal action, applying the filter to the selected ports to identify masked ports, wherein the packet is prevented from being sent to the masked ports.

15. The method of claim 14 , wherein the mirror-steal action includes performing a checking functionality on the packet and the method includes:

re-forwarding the packet to the masked ports if the packet is approved by the checking functionality; and

dropping the packet if the packet is not approved by the checking functionality.

16. The method of claim 14 , wherein the mirror-stealing action includes stealing the packet if a particular action bit is set and removing an associated port from an access list.

17. The method of claim 16 , wherein the method includes setting a mirror bit.

18. The method of claim 14 , wherein the method includes setting a mirror bit if the mirror action is determined to be the mirror-steal action.

19. A network chip operable with a number of network ports of a device for receiving and transmitting packets therefrom, the chip comprising:

circuitry, including logic;

wherein the logic is operable to mirror a packet on a per port per virtual local area network (VLAN) membership basis by selecting ports for a mirror action according to a network port receiving the packet and a VLAN for the port, and

the logic is operable to identify a mirror index according to the VLAN for the port and use the mirror index to determine whether the mirror action is a mirror-only action or a mirror-steal action and to identify a filter according to the mirror index to apply to the selected ports for the mirror action,

if the mirror action is determined to be the mirror-only action, the logic is operable to apply the filter to the selected ports to select ports for the mirror-only action, and

if the mirror action is determined to be the mirror-steal action, the logic is operable to apply the filter to the selected ports to identify masked ports, wherein the packet is prevented from being sent to the masked ports.