mirror icon indicating copy to clipboard operation
mirror copied to clipboard

请问下,我使用mirror工具镜像流量,导致包量陡增?

Open zorogong opened this issue 6 years ago • 1 comments

测试流程如下: 测试服务器A:10.0.0.3 用户请求 测试服务器B:10.0.0.4 mirror所在机器 单网卡 测试服务器C:172.17.122.172 用于接收镜像流量

(1)在服务器A上一直Ping 10.0.0.4 (2)服务器B:网卡enp0s31f6的mac地址为50:9a:4c:04:b0:a5 ,下一条mac为6c:b0:ce:bc:b3:75 ,我只镜像icmp的请求 ./sbin/mirror -t 6c:b0:ce:bc:b3:75 -s 50:9a:4c:04:b0:a5 -x 172.17.122.172 -i enp0s31f6 -o enp0s31f6 -F 'icmp[0] == 8' (2)在服务器B上抓包发现发送大量重复172.17.122.172,但是服务器A上请求频率很低,每秒一次

zorogong avatar May 28 '18 09:05 zorogong

在服务器B上抓包结果如下:

[root@localhost ~]# head mylog -n 100 17:45:18.254111 50:9a:4c:04:b3:1d > 50:9a:4c:04:b0:a5, ethertype IPv4 (0x0800), length 98: 10.0.0.3 > 10.0.0.4: ICMP echo request, id 6361, seq 477, length 64 17:45:19.253984 50:9a:4c:04:b3:1d > 50:9a:4c:04:b0:a5, ethertype IPv4 (0x0800), length 98: 10.0.0.3 > 10.0.0.4: ICMP echo request, id 6361, seq 478, length 64 17:45:20.254079 50:9a:4c:04:b3:1d > 50:9a:4c:04:b0:a5, ethertype IPv4 (0x0800), length 98: 10.0.0.3 > 10.0.0.4: ICMP echo request, id 6361, seq 479, length 64 17:45:20.254247 50:9a:4c:04:b0:a5 > 6c:b0:ce:bc:b3:75, ethertype IPv4 (0x0800), length 98: 10.0.0.3 > 172.17.122.172: ICMP echo request, id 6361, seq 479, length 64 17:45:20.254260 50:9a:4c:04:b0:a5 > 6c:b0:ce:bc:b3:75, ethertype IPv4 (0x0800), length 98: 10.0.0.3 > 172.17.122.172: ICMP echo request, id 6361, seq 479, length 64 17:45:20.254267 50:9a:4c:04:b0:a5 > 6c:b0:ce:bc:b3:75, ethertype IPv4 (0x0800), length 98: 10.0.0.3 > 172.17.122.172: ICMP echo request, id 6361, seq 479, length 64 17:45:20.254272 50:9a:4c:04:b0:a5 > 6c:b0:ce:bc:b3:75, ethertype IPv4 (0x0800), length 98: 10.0.0.3 > 172.17.122.172: ICMP echo request, id 6361, seq 479, length 64 17:45:20.254277 50:9a:4c:04:b0:a5 > 6c:b0:ce:bc:b3:75, ethertype IPv4 (0x0800), length 98: 10.0.0.3 > 172.17.122.172: ICMP echo request, id 6361, seq 479, length 64 17:45:20.254283 50:9a:4c:04:b0:a5 > 6c:b0:ce:bc:b3:75, ethertype IPv4 (0x0800), length 98: 10.0.0.3 > 172.17.122.172: ICMP echo request, id 6361, seq 479, length 64 17:45:20.254289 50:9a:4c:04:b0:a5 > 6c:b0:ce:bc:b3:75, ethertype IPv4 (0x0800), length 98: 10.0.0.3 > 172.17.122.172: ICMP echo request, id 6361, seq 479, length 64 17:45:20.254294 50:9a:4c:04:b0:a5 > 6c:b0:ce:bc:b3:75, ethertype IPv4 (0x0800), length 98: 10.0.0.3 > 172.17.122.172: ICMP echo request, id 6361, seq 479, length 64 17:45:20.254299 50:9a:4c:04:b0:a5 > 6c:b0:ce:bc:b3:75, ethertype IPv4 (0x0800), length 98: 10.0.0.3 > 172.17.122.172: ICMP echo request, id 6361, seq 479, length 64 ............ 很多重复的包,但是从10.0.0.3到10.0.0.4的包量很少,每秒一个

zorogong avatar May 28 '18 09:05 zorogong