Using Port Mirroring on the Quidway Switch to Capture Packets

First set the monitoring port then set the mirror port

This post was last edited by WheatGrass at 2018-08-06 06:10. Configuring 1:1 Port Mirroring

You can copy packets on a mirrored port to an observing port.
For example, copy incoming packets (received packets) on mirrored port GE0/0/2 to observing port GE0/0/1. GE0/0/1 is directly connected to a monitoring device.

system-view
[HUAWEI] observe-port 1 interface gigabitethernet 0/0/1
[HUAWEI] interface gigabitethernet 0/0/2
[HUAWEI-GigabitEthernet0/0/2] port-mirroring to observe-port 1 inbound

Configuring 1:N Port Mirroring

You can copy packets on one mirrored port to N observing ports. For example, copy incoming packets (received packets) on mirrored port GE2/0/1 to observing ports GE1/0/1 through GE1/0/3. These observing ports are directly connected to monitoring devices.•Configure observing ports one by one.

system-view
[HUAWEI] observe-port 1 interface gigabitethernet 1/0/1
[HUAWEI] observe-port 2 interface gigabitethernet 1/0/2
[HUAWEI] observe-port 3 interface gigabitethernet 1/0/3
[HUAWEI] interface gigabitethernet 2/0/1
[HUAWEI-GigabitEthernet2/0/1] port-mirroring to observe-port 1 inbound
[HUAWEI-GigabitEthernet2/0/1] port-mirroring to observe-port 2 inbound
[HUAWEI-GigabitEthernet2/0/1] port-mirroring to observe-port 3 inbound

Configure observing ports in a batch (only in V200R005 and later versions).

system-view
[HUAWEI] observe-port 1 interface-range gigabitethernet 1/0/1 to gigabitEthernet 1/0/3
[HUAWEI] interface gigabitethernet 2/0/1
[HUAWEI-GigabitEthernet2/0/1] port-mirroring to observe-port 1 inbound

Configuring N:1 Port Mirroring

You can copy packets on N mirrored ports to one observing port. For example, copy incoming packets (received packets) on mirrored ports GE0/0/1 through GE0/0/3 to observing port GE0/0/10. GE0/0/10 is directly connected to a monitoring device.

system-view
[HUAWEI] observe-port 1 interface gigabitethernet 0/0/10
[HUAWEI] interface gigabitethernet 0/0/1
[HUAWEI-GigabitEthernet0/0/1] port-mirroring to observe-port 1 inbound
[HUAWEI-GigabitEthernet0/0/1] quit
[HUAWEI] interface gigabitethernet 0/0/2
[HUAWEI-GigabitEthernet0/0/2] port-mirroring to observe-port 1 inbound
[HUAWEI-GigabitEthernet0/0/2] quit[HUAWEI] interface gigabitethernet 0/0/3
[HUAWEI-GigabitEthernet0/0/3] port-mirroring to observe-port 1 inbound
[HUAWEI-GigabitEthernet0/0/3] quit

You may also refer to this link: https://forum.huawei.com/enterprise/en/thread-253499.html

Here are the detailed steps:

1) Access the switch by running the following command:
[Quidway]system

2)To set the monitoring port, run the following command:

[Quidway]observe-port 1 interface ethernet 0/0/20

*Note that only one monitoring port is allowed.

3) To set the mirror port, run the following commands:

[Quidway]interface ethernet 0/0/12
[Quidway-Ethernet0/0/1]port-mirroring to observer-port 1 both

*Note that multiple mirror ports are allowed. Three mirroring modes are available: BOTH, INBOUND, and
OUTBOUND.

both: Data can be transmitted from the computer to the switch and vice versa.
inbound: Data can only be transmitted from the computer to the switch.
outbound: Data can only be transmitted from the switch to the computer.

The mirror port's mode must be consistent with that of the monitoring port.
To check the monitoring port's mode, run the following command:
[Quidway]display port-mirroring

4) To cancel port mirroring, run the following commands:

[Quidway]interface ethernet 0/0/1
[Quidway-Ethernet0/0/1]undo port-mirroring both
[Quidway-Ethernet0/0/1]quit
[Quidway]undo observe-port 1

***And to cancel port mirroring, disable the monitoring port then the mirror port.

Hi,
The port mirroring function can duplicate the packets of the designated service interface to the non-service interfaces. When the session is abnormal, the problem can be located by checking the protocol analyzer connected to the non-service interface, without affecting normal services. The service interface is called "mirroring port". The non-service interface is called "observing port."
In order to configure port mirroring on your device please refer to the following link:
http://support.huawei.com/hedex/hdx.do?docid=EDOC1000000870&id=sec_vsp_cfg_sysdebug_0017&text=Configuring%252520Port%252520Mirroring&lang=en

Great Thanks

Thanks