Huawei Quidway S9300 Configuration Manual page 110

Quidway S9300 Terabit Routing Switch
Configuration Guide - Device Management
l
l
Flow Mirroring
For flow mirroring, the S9300 copies specified data passing through a flow mirroring interface
to a specified observing port or the CPU for analysis and monitoring. A flow mirroring interface
refers to the interface that a traffic policy containing flow mirroring behaviors is applied to. If
the packets passing through the flow mirroring interface match a traffic classifier in the traffic
policy on this interface, the packets are copied and sent to an observing port or the CPU. See
Figure
Issue 03 (2011-12-29)
Local port mirroring
In local port mirroring, a monitoring host is directly connected to an observing port.
Remote port mirroring
In remote port mirroring, a monitoring host is connected to the device where an observing
port is located over a Layer 2 or Layer 3 network.
– Layer 2 port mirroring: The Remote Switched Port Analyzer (RSPAN) is used. If a
monitoring host is connected to the device where an observing port is located over a
Layer 2 network, the S9300 adds a VLAN tag to packets sent from a mirroring interface
and then broadcasts the packets in the VLAN through the observing port. After receiving
the packets, the remote device compares its VLAN ID with the VLAN ID of packets.
If the VLAN IDs are the same, the remote device forwards the packets to a remote
observing port.
– Layer 3 port mirroring: The Encapsulated Remote SPAN (ERSPAN) is used. If a
monitoring host is connected to the device where an observing port is located over a
Layer 3 network, the S9300 adds a Generic Routing Encapsulation (GRE) header to
encapsulate and decapsulate mirroring packets. In this manner, the mirroring packets
can traverse the Layer 3 network.
NOTE
In local port mirroring and remote port mirroring, observing and mirroring interfaces are configured on
the same device.
You can configure eight observing ports on the S9300, but the traffic in a direction can be mirrored to only
one observing port.
A packet is copied from the mirroring interface to the observing port before its tag is removed; therefore,
packets sent from the observing port all contain tags.
The packets on the mirrored port are copied to the observing port; therefore, the observing port is considered
as the outbound interface of the packets. In this case, the discarded packets are not counted.
6-2.
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
6 Mirroring Configuration
98