| 场景 | 协议分析、异常流量取证 |
|---|---|
| 适用 | 全部交换机 |
| 命令族 | mirror to observe-port / monitor session / mirroring-group |
华为 VRP
华为 VRP
[Huawei] observe-port 1 interface GigabitEthernet 0/0/24 ! 观察口
[Huawei] interface GigabitEthernet 0/0/1
[Huawei-GigabitEthernet0/0/1] mirror to observe-port 1 inbound
! 双向：mirror to observe-port 1 both思科 IOS
思科 IOS
SW-CORE-01(config)# monitor session 1 source interface GigabitEthernet1/0/1 both
SW-CORE-01(config)# monitor session 1 destination interface GigabitEthernet1/0/24
! 查看：show monitor session 1H3C Comware
H3C Comware
[H3C] mirroring-group 1 local
[H3C] mirroring-group 1 mirroring-port GigabitEthernet 1/0/1 both
[H3C] mirroring-group 1 monitor-port GigabitEthernet 1/0/24
<H3C> display mirroring-group alldirection 取值：inbound/outbound/both（华为 mirror 到观察口）；思科 source ... both；H3C mirroring-port ... both。观察口将不再转发业务流量，别复用上联口。