Este conteúdo não está disponível no idioma selecionado.

Chapter 48. Mirroring a network interface by using nmcli


Network administrators can use port mirroring to replicate inbound and outbound network traffic being communicated from one network device to another. Mirroring traffic of an interface can be helpful in the following situations:

  • To debug networking issues and tune the network flow
  • To inspect and analyze the network traffic
  • To detect an intrusion

Prerequisites

  • A network interface to mirror the network traffic to.

Procedure

  1. Add a network connection profile that you want to mirror the network traffic from:

    # nmcli connection add type ethernet ifname enp1s0 con-name enp1s0 autoconnect no
  2. Attach a prio qdisc to enp1s0 for the egress (outgoing) traffic with the 10: handle:

    # nmcli connection modify enp1s0 +tc.qdisc "root prio handle 10:"

    The prio qdisc attached without children allows attaching filters.

  3. Add a qdisc for the ingress traffic, with the ffff: handle:

    # nmcli connection modify enp1s0 +tc.qdisc "ingress handle ffff:"
  4. Add the following filters to match packets on the ingress and egress qdiscs, and to mirror them to enp7s0:

    # nmcli connection modify enp1s0 +tc.tfilter "parent ffff: matchall action mirred egress mirror dev enp7s0"
    
    # nmcli connection modify enp1s0 +tc.tfilter "parent 10: matchall action mirred egress mirror dev enp7s0"

    The matchall filter matches all packets, and the mirred action redirects packets to destination.

  5. Activate the connection:

    # nmcli connection up enp1s0

Verification

  1. Install the tcpdump utility:

    # yum install tcpdump
  2. Display the traffic mirrored on the target device (enp7s0):

    # tcpdump -i enp7s0

Additional resources

Red Hat logoGithubRedditYoutubeTwitter

Aprender

Experimente, compre e venda

Comunidades

Sobre a documentação da Red Hat

Ajudamos os usuários da Red Hat a inovar e atingir seus objetivos com nossos produtos e serviços com conteúdo em que podem confiar.

Tornando o open source mais inclusivo

A Red Hat está comprometida em substituir a linguagem problemática em nosso código, documentação e propriedades da web. Para mais detalhes veja oBlog da Red Hat.

Sobre a Red Hat

Fornecemos soluções robustas que facilitam o trabalho das empresas em plataformas e ambientes, desde o data center principal até a borda da rede.

© 2024 Red Hat, Inc.