一、问题现象
配置端口镜像后,采集设备与观察端口相连,无法接收镜像流量。
二、原因分析
镜像端口未实际接收或发送报文。
镜像端口/观察端口配置错误(如编号不匹配、镜像方向错误)。
观察端口状态异常或未正常转发镜像报文。
三、处理步骤
步骤1:检查镜像端口是否有流量收发
1.查看镜像端口状态及流量统计
[shaiops]display interface
XGigabitEthernet0/0/1 current state : UP
Line protocol current state : UP
Description:
Switch Port, Link-type : access(configured),
PVID : 70, TPID : 8100(Hex), The Maximum Frame Length is 9216
IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 5825-7570-b480
Last physical up time : 2025-04-09 16:42:46
Last physical down time : 2025-04-09 16:42:44
Current system time: 2025-04-09 23:24:24
Port Mode: COMMON FIBER, Transceiver: 10GBASE_SR_SFP
Speed : 10000, Loopback: NONE
Duplex: FULL, Negotiation: DISABLE
Mdi : -, Flow-control: DISABLE
Last 300 seconds input rate 208 bits/sec, 0 packets/sec
Last 300 seconds output rate 1616 bits/sec, 1 packets/sec
Input peak rate 3305897912 bits/sec, Record time: 2023-11-21 13:25:24
Output peak rate 2431563400 bits/sec, Record time: 2025-04-03 18:20:06
Input: 41542895 packets, 20189094866 bytes
Unicast: 36559699, Multicast: 4616806
Broadcast: 348904, Jumbo: 0
Discard: 0, Pause: 17486
Frames: 0
Total Error: 0
CRC: 0, Giants: 0
Runts: 0, DropEvents: 0
Alignments: 0, Symbols: 0
Ignoreds: 0
Output: 100154555 packets, 47823649876 bytes
Unicast: 38696600, Multicast: 57022143
Broadcast: 4435812, Jumbo: 0
Discard: 17, Pause: 0
Total Error: 0
Collisions: 0, Late Collisions: 0
Deferreds: 0
Input bandwidth utilization threshold : 80.00%
Output bandwidth utilization threshold: 80.00%
Input bandwidth utilization : 0%
Output bandwidth utilization : 0%
重点关注镜像端口的Input(接收报文)和Output(发送报文)统计信息。
2.根据统计信息判断
若 Input/Output均为0或无变化:
检查镜像端口状态:若接口状态为Down,先解决端口故障(如物理、协议问题)。
若接口状态为Up,但无流量,说明设备与被采集设备网络间无实际流量,非镜像配置故障。
若 Input/Output不为0且变化则进行步骤2。
步骤2:检查镜像端口配置是否正确
1.验证镜像端口与观察端口的映射关系及镜像方向
[shaiops]display port-mirroring
----------------------------------------------------------------------
Observe-port 1 : XGigabitEthernet0/0/30 XGigabitEthernet0/0/48
----------------------------------------------------------------------
Port-mirror:
----------------------------------------------------------------------
Mirror-port Direction Observe-port
----------------------------------------------------------------------
1 Eth-Trunk5 Inbound Observe-port 1
2 Eth-Trunk5 Outbound Observe-port 1
3 Eth-Trunk12 Inbound Observe-port 1
4 Eth-Trunk12 Outbound Observe-port 1
5 Eth-Trunk13 Inbound Observe-port 1
6 Eth-Trunk13 Outbound Observe-port 1
7 Eth-Trunk14 Inbound Observe-port 1
8 Eth-Trunk14 Outbound Observe-port 1
9 Eth-Trunk15 Inbound Observe-port 1
10 Eth-Trunk15 Outbound Observe-port 1
11 Eth-Trunk16 Inbound Observe-port 1
12 Eth-Trunk16 Outbound Observe-port 1
13 XGigabitEthernet0/0/10 Inbound Observe-port 1
14 XGigabitEthernet0/0/10 Outbound Observe-port 1
确认镜像端口配置的观察端口编号、镜像方向(入方向/出方向/双向)与实际需求一致。
2.若配置错误进行修改
若配置错误,进入镜像端口接口视图重新配置:
interface XGigabitEthernet0/0/10
port-mirroring to observe-port Observe-port 1 [inbound/outbound/both]
配置完成后进入步骤3再次查看。
步骤3:检查观察端口是否发送镜像报文
1.查看观察端口的流量发送统计
[shaiops]display interface
XGigabitEthernet0/0/1 current state : UP
Line protocol current state : UP
Description:
Switch Port, Link-type : access(configured),
PVID : 70, TPID : 8100(Hex), The Maximum Frame Length is 9216
IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 5825-7570-b480
Last physical up time : 2025-04-09 16:42:46
Last physical down time : 2025-04-09 16:42:44
Current system time: 2025-04-09 23:24:24
Port Mode: COMMON FIBER, Transceiver: 10GBASE_SR_SFP
Speed : 10000, Loopback: NONE
Duplex: FULL, Negotiation: DISABLE
Mdi : -, Flow-control: DISABLE
Last 300 seconds input rate 208 bits/sec, 0 packets/sec
Last 300 seconds output rate 1616 bits/sec, 1 packets/sec
Input peak rate 3305897912 bits/sec, Record time: 2023-11-21 13:25:24
Output peak rate 2431563400 bits/sec, Record time: 2025-04-03 18:20:06
Input: 41542895 packets, 20189094866 bytes
Unicast: 36559699, Multicast: 4616806
Broadcast: 348904, Jumbo: 0
Discard: 0, Pause: 17486
Frames: 0
Total Error: 0
CRC: 0, Giants: 0
Runts: 0, DropEvents: 0
Alignments: 0, Symbols: 0
Ignoreds: 0
Output: 100154555 packets, 47823649876 bytes
Unicast: 38696600, Multicast: 57022143
Broadcast: 4435812, Jumbo: 0
Discard: 17, Pause: 0
Total Error: 0
Collisions: 0, Late Collisions: 0
Deferreds: 0
Input bandwidth utilization threshold : 80.00%
Output bandwidth utilization threshold: 80.00%
Input bandwidth utilization : 0%
Output bandwidth utilization : 0%
重点关注观察端口的 Output 统计信息。
2.根据统计信息判断
若Output为0或无变化:
检查观察端口状态:若接口状态为Down,解决端口故障(如物理、端口是否是否开启等问题)。
若接口状态为Up,且镜像配置正确,可能为设备到采集设备的链路问题(如网线、交换机端口故障)。
若Output不为0且变化:说明观察端口已发送镜像报文,需检查采集设备侧(如端口抓包、配置过滤规则)。
四、总结经验
优先确认镜像端口是否有真实流量,排除 “无流量” 的误判场景。
严格核对镜像端口与观察端口的编号、镜像方向配置。
观察端口状态及流量发送统计是关键验证点,需结合设备侧与采集侧链路排查。