一、问题现象

配置端口镜像后,采集设备与观察端口相连,无法接收镜像流量。

二、原因分析

  1. 镜像端口未实际接收或发送报文。

  2. 镜像端口/观察端口配置错误(如编号不匹配、镜像方向错误)。

  3. 观察端口状态异常或未正常转发镜像报文。

三、处理步骤

步骤1:检查镜像端口是否有流量收发

1.查看镜像端口状态及流量统计

[shaiops]display interface 
XGigabitEthernet0/0/1 current state : UP
Line protocol current state : UP
Description:
Switch Port, Link-type : access(configured),
PVID :   70, TPID : 8100(Hex), The Maximum Frame Length is 9216
IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 5825-7570-b480
Last physical up time   : 2025-04-09 16:42:46
Last physical down time : 2025-04-09 16:42:44
Current system time: 2025-04-09 23:24:24  
Port Mode: COMMON FIBER, Transceiver: 10GBASE_SR_SFP
Speed : 10000,  Loopback: NONE
Duplex: FULL,   Negotiation: DISABLE
Mdi   : -,      Flow-control: DISABLE
Last 300 seconds input rate 208 bits/sec, 0 packets/sec
Last 300 seconds output rate 1616 bits/sec, 1 packets/sec
Input peak rate 3305897912 bits/sec, Record time: 2023-11-21 13:25:24
Output peak rate 2431563400 bits/sec, Record time: 2025-04-03 18:20:06

Input:  41542895 packets, 20189094866 bytes
  Unicast:                   36559699,  Multicast:                     4616806
  Broadcast:                   348904,  Jumbo:                               0
  Discard:                          0,  Pause:                           17486
  Frames:                           0

  Total Error:                      0
  CRC:                              0,  Giants:                              0
  Runts:                            0,  DropEvents:                          0
  Alignments:                       0,  Symbols:                             0
  Ignoreds:                         0

Output:  100154555 packets, 47823649876 bytes
  Unicast:                   38696600,  Multicast:                    57022143
  Broadcast:                  4435812,  Jumbo:                               0
  Discard:                         17,  Pause:                               0

  Total Error:                      0
  Collisions:                       0,  Late Collisions:                     0
  Deferreds:                        0

    Input bandwidth utilization threshold : 80.00%
    Output bandwidth utilization threshold: 80.00%
    Input bandwidth utilization  :    0%
    Output bandwidth utilization :    0%

重点关注镜像端口的Input(接收报文)和Output(发送报文)统计信息。

2.根据统计信息判断

  • 若 Input/Output均为0或无变化:

  • 检查镜像端口状态:若接口状态为Down,先解决端口故障(如物理、协议问题)。

  • 若接口状态为Up,但无流量,说明设备与被采集设备网络间无实际流量,非镜像配置故障。

  • 若 Input/Output不为0且变化则进行步骤2。

步骤2:检查镜像端口配置是否正确

1.验证镜像端口与观察端口的映射关系及镜像方向

[shaiops]display port-mirroring
  ----------------------------------------------------------------------
  Observe-port 1 : XGigabitEthernet0/0/30 XGigabitEthernet0/0/48
  ----------------------------------------------------------------------
  Port-mirror:
  ----------------------------------------------------------------------
       Mirror-port               Direction  Observe-port             
  ----------------------------------------------------------------------
  1    Eth-Trunk5                Inbound    Observe-port 1           
  2    Eth-Trunk5                Outbound   Observe-port 1           
  3    Eth-Trunk12               Inbound    Observe-port 1           
  4    Eth-Trunk12               Outbound   Observe-port 1           
  5    Eth-Trunk13               Inbound    Observe-port 1           
  6    Eth-Trunk13               Outbound   Observe-port 1           
  7    Eth-Trunk14               Inbound    Observe-port 1           
  8    Eth-Trunk14               Outbound   Observe-port 1           
  9    Eth-Trunk15               Inbound    Observe-port 1           
  10   Eth-Trunk15               Outbound   Observe-port 1           
  11   Eth-Trunk16               Inbound    Observe-port 1           
  12   Eth-Trunk16               Outbound   Observe-port 1           
  13   XGigabitEthernet0/0/10    Inbound    Observe-port 1           
  14   XGigabitEthernet0/0/10    Outbound   Observe-port 1 

确认镜像端口配置的观察端口编号、镜像方向(入方向/出方向/双向)与实际需求一致。

2.若配置错误进行修改

若配置错误,进入镜像端口接口视图重新配置:

interface XGigabitEthernet0/0/10
port-mirroring to observe-port Observe-port 1 [inbound/outbound/both]

配置完成后进入步骤3再次查看。

步骤3:检查观察端口是否发送镜像报文

1.查看观察端口的流量发送统计

[shaiops]display interface 
XGigabitEthernet0/0/1 current state : UP
Line protocol current state : UP
Description:
Switch Port, Link-type : access(configured),
PVID :   70, TPID : 8100(Hex), The Maximum Frame Length is 9216
IP Sending Frames' Format is PKTFMT_ETHNT_2, Hardware address is 5825-7570-b480
Last physical up time   : 2025-04-09 16:42:46
Last physical down time : 2025-04-09 16:42:44
Current system time: 2025-04-09 23:24:24  
Port Mode: COMMON FIBER, Transceiver: 10GBASE_SR_SFP
Speed : 10000,  Loopback: NONE
Duplex: FULL,   Negotiation: DISABLE
Mdi   : -,      Flow-control: DISABLE
Last 300 seconds input rate 208 bits/sec, 0 packets/sec
Last 300 seconds output rate 1616 bits/sec, 1 packets/sec
Input peak rate 3305897912 bits/sec, Record time: 2023-11-21 13:25:24
Output peak rate 2431563400 bits/sec, Record time: 2025-04-03 18:20:06

Input:  41542895 packets, 20189094866 bytes
  Unicast:                   36559699,  Multicast:                     4616806
  Broadcast:                   348904,  Jumbo:                               0
  Discard:                          0,  Pause:                           17486
  Frames:                           0

  Total Error:                      0
  CRC:                              0,  Giants:                              0
  Runts:                            0,  DropEvents:                          0
  Alignments:                       0,  Symbols:                             0
  Ignoreds:                         0

Output:  100154555 packets, 47823649876 bytes
  Unicast:                   38696600,  Multicast:                    57022143
  Broadcast:                  4435812,  Jumbo:                               0
  Discard:                         17,  Pause:                               0

  Total Error:                      0
  Collisions:                       0,  Late Collisions:                     0
  Deferreds:                        0

    Input bandwidth utilization threshold : 80.00%
    Output bandwidth utilization threshold: 80.00%
    Input bandwidth utilization  :    0%
    Output bandwidth utilization :    0%

重点关注观察端口的 Output 统计信息。

2.根据统计信息判断

  • 若Output为0或无变化:

  • 检查观察端口状态:若接口状态为Down,解决端口故障(如物理、端口是否是否开启等问题)。

  • 若接口状态为Up,且镜像配置正确,可能为设备到采集设备的链路问题(如网线、交换机端口故障)。

  • 若Output不为0且变化:说明观察端口已发送镜像报文,需检查采集设备侧(如端口抓包、配置过滤规则)。

四、总结经验

  1. 优先确认镜像端口是否有真实流量,排除 “无流量” 的误判场景。

  2. 严格核对镜像端口与观察端口的编号、镜像方向配置。

  3. 观察端口状态及流量发送统计是关键验证点,需结合设备侧与采集侧链路排查。