华为 S5735 端口镜像配置：网络故障排查的利器

一、 端口镜像概述：为何是网络排障的利器

1.1 什么是端口镜像

端口镜像，也称为SPAN（Switched Port Analyzer），是一种网络监控技术。它允许将交换机上一个或多个源端口（或VLAN）的流量复制一份，发送到指定的目的端口。连接在目的端口的分析工具（如Wireshark）可以捕获并分析这些复制的流量，而不会影响源端口的正常数据传输。这就像在数据流经的管道上开了一个“观察窗”，让我们在不中断业务的情况下洞察网络内部的数据交换情况。

1.2 端口镜像的核心价值

在网络故障排查中，端口镜像的价值体现在：

二、 华为 S5735 端口镜像类型：选择合适的模式

S5735支持两种主要的端口镜像模式，以满足不同的组网和监控需求。

2.1 本地端口镜像

本地端口镜像是指源端口和目的端口位于同一台交换机上。这是最简单、最常见的镜像方式，适用于在单个交换机上监控特定端口的流量。

2.2 远程端口镜像

远程端口镜像允许将源端口（位于源交换机）的流量镜像到远程的目的端口（位于目的交换机）。这种方式适用于需要将流量集中到一台高性能分析设备，或者源交换机和目的交换机物理位置分离的场景。

2.3 镜像类型对比

三、 S5735 端口镜像配置步骤：从理论到实践

在配置之前，请务必做好规划，明确以下信息：

3.1 本地端口镜像配置示例

假设我们需要监控 S5735 交换机上 GigabitEthernet0/0/1 端口的流量，并将镜像流量发送到 GigabitEthernet0/0/10 端口。配置步骤如下：

#publish-mermaid-0-1793422931721{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#publish-mermaid-0-1793422931721 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#publish-mermaid-0-1793422931721 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#publish-mermaid-0-1793422931721 .error-icon{fill:#552222;}#publish-mermaid-0-1793422931721 .error-text{fill:#552222;stroke:#552222;}#publish-mermaid-0-1793422931721 .edge-thickness-normal{stroke-width:1px;}#publish-mermaid-0-1793422931721 .edge-thickness-thick{stroke-width:3.5px;}#publish-mermaid-0-1793422931721 .edge-pattern-solid{stroke-dasharray:0;}#publish-mermaid-0-1793422931721 .edge-thickness-invisible{stroke-width:0;fill:none;}#publish-mermaid-0-1793422931721 .edge-pattern-dashed{stroke-dasharray:3;}#publish-mermaid-0-1793422931721 .edge-pattern-dotted{stroke-dasharray:2;}#publish-mermaid-0-1793422931721 .marker{fill:#333333;stroke:#333333;}#publish-mermaid-0-1793422931721 .marker.cross{stroke:#333333;}#publish-mermaid-0-1793422931721 svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#publish-mermaid-0-1793422931721 p{margin:0;}#publish-mermaid-0-1793422931721 .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#publish-mermaid-0-1793422931721 .cluster-label text{fill:#333;}#publish-mermaid-0-1793422931721 .cluster-label span{color:#333;}#publish-mermaid-0-1793422931721 .cluster-label span p{background-color:transparent;}#publish-mermaid-0-1793422931721 .label text,#publish-mermaid-0-1793422931721 span{fill:#333;color:#333;}#publish-mermaid-0-1793422931721 .node rect,#publish-mermaid-0-1793422931721 .node circle,#publish-mermaid-0-1793422931721 .node ellipse,#publish-mermaid-0-1793422931721 .node polygon,#publish-mermaid-0-1793422931721 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#publish-mermaid-0-1793422931721 .rough-node .label text,#publish-mermaid-0-1793422931721 .node .label text,#publish-mermaid-0-1793422931721 .image-shape .label,#publish-mermaid-0-1793422931721 .icon-shape .label{text-anchor:middle;}#publish-mermaid-0-1793422931721 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#publish-mermaid-0-1793422931721 .rough-node .label,#publish-mermaid-0-1793422931721 .node .label,#publish-mermaid-0-1793422931721 .image-shape .label,#publish-mermaid-0-1793422931721 .icon-shape .label{text-align:center;}#publish-mermaid-0-1793422931721 .node.clickable{cursor:pointer;}#publish-mermaid-0-1793422931721 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#publish-mermaid-0-1793422931721 .arrowheadPath{fill:#333333;}#publish-mermaid-0-1793422931721 .edgePath .path{stroke:#333333;stroke-width:1px;}#publish-mermaid-0-1793422931721 .flowchart-link{stroke:#333333;fill:none;}#publish-mermaid-0-1793422931721 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#publish-mermaid-0-1793422931721 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#publish-mermaid-0-1793422931721 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#publish-mermaid-0-1793422931721 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#publish-mermaid-0-1793422931721 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#publish-mermaid-0-1793422931721 .cluster text{fill:#333;}#publish-mermaid-0-1793422931721 .cluster span{color:#333;}#publish-mermaid-0-1793422931721 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#publish-mermaid-0-1793422931721 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#publish-mermaid-0-1793422931721 rect.text{fill:none;stroke-width:0;}#publish-mermaid-0-1793422931721 .icon-shape,#publish-mermaid-0-1793422931721 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#publish-mermaid-0-1793422931721 .icon-shape p,#publish-mermaid-0-1793422931721 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#publish-mermaid-0-1793422931721 .icon-shape .label rect,#publish-mermaid-0-1793422931721 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#publish-mermaid-0-1793422931721 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#publish-mermaid-0-1793422931721 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#publish-mermaid-0-1793422931721 .node .neo-node{stroke:#9370DB;}#publish-mermaid-0-1793422931721 [data-look=\”neo\”].node rect,#publish-mermaid-0-1793422931721 [data-look=\”neo\”].cluster rect,#publish-mermaid-0-1793422931721 [data-look=\”neo\”].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-0-1793422931721 [data-look=\”neo\”].swimlane.cluster rect{filter:none;}#publish-mermaid-0-1793422931721 [data-look=\”neo\”].node path{stroke:#9370DB;stroke-width:1px;}#publish-mermaid-0-1793422931721 [data-look=\”neo\”].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-0-1793422931721 [data-look=\”neo\”].node .neo-line path{stroke:#9370DB;filter:none;}#publish-mermaid-0-1793422931721 [data-look=\”neo\”].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-0-1793422931721 [data-look=\”neo\”].node circle .state-start{fill:#000000;}#publish-mermaid-0-1793422931721 [data-look=\”neo\”].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-0-1793422931721 [data-look=\”neo\”].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-0-1793422931721 :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

进入系统视图

创建本地镜像组

配置源端口

配置目的端口

应用配置完成

该流程图清晰地展示了从创建镜像组到应用配置的完整步骤。

具体配置命令如下：

system-view
# 创建本地镜像组 1
mirroring-group 1 local
# 将 GE0/0/1 配置为源端口，入方向和出方向流量均镜像
mirroring-group 1 monitor-port GigabitEthernet0/0/1 both
# 将 GE0/0/10 配置为目的端口
mirroring-group 1 reflect-port GigabitEthernet0/0/10

3.2 远程端口镜像配置示例

假设源交换机为 S5735-A，目的交换机为 S5735-B。我们需要将 S5735-A 上 GigabitEthernet0/0/1 端口的流量镜像到 S5735-B 的 GigabitEthernet0/0/20 端口。

#publish-mermaid-1-1793422931766{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#publish-mermaid-1-1793422931766 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#publish-mermaid-1-1793422931766 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#publish-mermaid-1-1793422931766 .error-icon{fill:#552222;}#publish-mermaid-1-1793422931766 .error-text{fill:#552222;stroke:#552222;}#publish-mermaid-1-1793422931766 .edge-thickness-normal{stroke-width:1px;}#publish-mermaid-1-1793422931766 .edge-thickness-thick{stroke-width:3.5px;}#publish-mermaid-1-1793422931766 .edge-pattern-solid{stroke-dasharray:0;}#publish-mermaid-1-1793422931766 .edge-thickness-invisible{stroke-width:0;fill:none;}#publish-mermaid-1-1793422931766 .edge-pattern-dashed{stroke-dasharray:3;}#publish-mermaid-1-1793422931766 .edge-pattern-dotted{stroke-dasharray:2;}#publish-mermaid-1-1793422931766 .marker{fill:#333333;stroke:#333333;}#publish-mermaid-1-1793422931766 .marker.cross{stroke:#333333;}#publish-mermaid-1-1793422931766 svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#publish-mermaid-1-1793422931766 p{margin:0;}#publish-mermaid-1-1793422931766 .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#publish-mermaid-1-1793422931766 .cluster-label text{fill:#333;}#publish-mermaid-1-1793422931766 .cluster-label span{color:#333;}#publish-mermaid-1-1793422931766 .cluster-label span p{background-color:transparent;}#publish-mermaid-1-1793422931766 .label text,#publish-mermaid-1-1793422931766 span{fill:#333;color:#333;}#publish-mermaid-1-1793422931766 .node rect,#publish-mermaid-1-1793422931766 .node circle,#publish-mermaid-1-1793422931766 .node ellipse,#publish-mermaid-1-1793422931766 .node polygon,#publish-mermaid-1-1793422931766 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#publish-mermaid-1-1793422931766 .rough-node .label text,#publish-mermaid-1-1793422931766 .node .label text,#publish-mermaid-1-1793422931766 .image-shape .label,#publish-mermaid-1-1793422931766 .icon-shape .label{text-anchor:middle;}#publish-mermaid-1-1793422931766 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#publish-mermaid-1-1793422931766 .rough-node .label,#publish-mermaid-1-1793422931766 .node .label,#publish-mermaid-1-1793422931766 .image-shape .label,#publish-mermaid-1-1793422931766 .icon-shape .label{text-align:center;}#publish-mermaid-1-1793422931766 .node.clickable{cursor:pointer;}#publish-mermaid-1-1793422931766 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#publish-mermaid-1-1793422931766 .arrowheadPath{fill:#333333;}#publish-mermaid-1-1793422931766 .edgePath .path{stroke:#333333;stroke-width:1px;}#publish-mermaid-1-1793422931766 .flowchart-link{stroke:#333333;fill:none;}#publish-mermaid-1-1793422931766 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#publish-mermaid-1-1793422931766 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#publish-mermaid-1-1793422931766 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#publish-mermaid-1-1793422931766 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#publish-mermaid-1-1793422931766 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#publish-mermaid-1-1793422931766 .cluster text{fill:#333;}#publish-mermaid-1-1793422931766 .cluster span{color:#333;}#publish-mermaid-1-1793422931766 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#publish-mermaid-1-1793422931766 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#publish-mermaid-1-1793422931766 rect.text{fill:none;stroke-width:0;}#publish-mermaid-1-1793422931766 .icon-shape,#publish-mermaid-1-1793422931766 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#publish-mermaid-1-1793422931766 .icon-shape p,#publish-mermaid-1-1793422931766 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#publish-mermaid-1-1793422931766 .icon-shape .label rect,#publish-mermaid-1-1793422931766 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#publish-mermaid-1-1793422931766 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#publish-mermaid-1-1793422931766 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#publish-mermaid-1-1793422931766 .node .neo-node{stroke:#9370DB;}#publish-mermaid-1-1793422931766 [data-look=\”neo\”].node rect,#publish-mermaid-1-1793422931766 [data-look=\”neo\”].cluster rect,#publish-mermaid-1-1793422931766 [data-look=\”neo\”].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-1-1793422931766 [data-look=\”neo\”].swimlane.cluster rect{filter:none;}#publish-mermaid-1-1793422931766 [data-look=\”neo\”].node path{stroke:#9370DB;stroke-width:1px;}#publish-mermaid-1-1793422931766 [data-look=\”neo\”].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-1-1793422931766 [data-look=\”neo\”].node .neo-line path{stroke:#9370DB;filter:none;}#publish-mermaid-1-1793422931766 [data-look=\”neo\”].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-1-1793422931766 [data-look=\”neo\”].node circle .state-start{fill:#000000;}#publish-mermaid-1-1793422931766 [data-look=\”neo\”].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-1-1793422931766 [data-look=\”neo\”].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-1-1793422931766 :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}目的交换机(S5735-B)源交换机(S5735-A)远程会话ID

创建远程镜像会话

配置源端口

配置远程目的

配置远程目的端口

此图展示了远程镜像在源设备和目的设备上的配置逻辑关系。

具体配置命令如下：

在源交换机 (S5735-A) 上：

system-view
# 创建远程镜像会话 10
mirroring-group 10 remote
# 将 GE0/0/1 配置为源端口
mirroring-group 10 monitor-port GigabitEthernet0/0/1 both
# 配置远程目的交换机的IP和目的端口
mirroring-group 10 remote-ip 192.168.1.2 reflect-port GigabitEthernet0/0/20

在目的交换机 (S5735-B) 上：

system-view
# 配置远程目的端口，注意端口的 hybrid 或 access 模式
interface GigabitEthernet0/0/20
port link-type hybrid
port hybrid untagged vlan 1
# 将该端口加入远程镜像会话 10
mirroring-group 10 reflect-port GigabitEthernet0/0/20

四、 镜像会话管理：查看与删除

配置完成后，可以通过命令行查看镜像会话的状态，并在不再需要时删除。

4.1 查看镜像会话

使用 display mirror-session 命令可以查看所有已配置的镜像会话的详细信息，包括会话ID、类型、源端口、目的端口等。

#publish-mermaid-2-1793422931815{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#publish-mermaid-2-1793422931815 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#publish-mermaid-2-1793422931815 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#publish-mermaid-2-1793422931815 .error-icon{fill:#552222;}#publish-mermaid-2-1793422931815 .error-text{fill:#552222;stroke:#552222;}#publish-mermaid-2-1793422931815 .edge-thickness-normal{stroke-width:1px;}#publish-mermaid-2-1793422931815 .edge-thickness-thick{stroke-width:3.5px;}#publish-mermaid-2-1793422931815 .edge-pattern-solid{stroke-dasharray:0;}#publish-mermaid-2-1793422931815 .edge-thickness-invisible{stroke-width:0;fill:none;}#publish-mermaid-2-1793422931815 .edge-pattern-dashed{stroke-dasharray:3;}#publish-mermaid-2-1793422931815 .edge-pattern-dotted{stroke-dasharray:2;}#publish-mermaid-2-1793422931815 .marker{fill:#333333;stroke:#333333;}#publish-mermaid-2-1793422931815 .marker.cross{stroke:#333333;}#publish-mermaid-2-1793422931815 svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#publish-mermaid-2-1793422931815 p{margin:0;}#publish-mermaid-2-1793422931815 .label{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;color:#333;}#publish-mermaid-2-1793422931815 .cluster-label text{fill:#333;}#publish-mermaid-2-1793422931815 .cluster-label span{color:#333;}#publish-mermaid-2-1793422931815 .cluster-label span p{background-color:transparent;}#publish-mermaid-2-1793422931815 .label text,#publish-mermaid-2-1793422931815 span{fill:#333;color:#333;}#publish-mermaid-2-1793422931815 .node rect,#publish-mermaid-2-1793422931815 .node circle,#publish-mermaid-2-1793422931815 .node ellipse,#publish-mermaid-2-1793422931815 .node polygon,#publish-mermaid-2-1793422931815 .node path{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#publish-mermaid-2-1793422931815 .rough-node .label text,#publish-mermaid-2-1793422931815 .node .label text,#publish-mermaid-2-1793422931815 .image-shape .label,#publish-mermaid-2-1793422931815 .icon-shape .label{text-anchor:middle;}#publish-mermaid-2-1793422931815 .node .katex path{fill:#000;stroke:#000;stroke-width:1px;}#publish-mermaid-2-1793422931815 .rough-node .label,#publish-mermaid-2-1793422931815 .node .label,#publish-mermaid-2-1793422931815 .image-shape .label,#publish-mermaid-2-1793422931815 .icon-shape .label{text-align:center;}#publish-mermaid-2-1793422931815 .node.clickable{cursor:pointer;}#publish-mermaid-2-1793422931815 .root .anchor path{fill:#333333!important;stroke-width:0;stroke:#333333;}#publish-mermaid-2-1793422931815 .arrowheadPath{fill:#333333;}#publish-mermaid-2-1793422931815 .edgePath .path{stroke:#333333;stroke-width:1px;}#publish-mermaid-2-1793422931815 .flowchart-link{stroke:#333333;fill:none;}#publish-mermaid-2-1793422931815 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#publish-mermaid-2-1793422931815 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#publish-mermaid-2-1793422931815 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#publish-mermaid-2-1793422931815 .labelBkg{background-color:rgba(232, 232, 232, 0.5);}#publish-mermaid-2-1793422931815 .cluster rect{fill:#ffffde;stroke:#aaaa33;stroke-width:1px;}#publish-mermaid-2-1793422931815 .cluster text{fill:#333;}#publish-mermaid-2-1793422931815 .cluster span{color:#333;}#publish-mermaid-2-1793422931815 div.mermaidTooltip{position:absolute;text-align:center;max-width:200px;padding:2px;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:12px;background:hsl(80, 100%, 96.2745098039%);border:1px solid #aaaa33;border-radius:2px;pointer-events:none;z-index:100;}#publish-mermaid-2-1793422931815 .flowchartTitleText{text-anchor:middle;font-size:18px;fill:#333;}#publish-mermaid-2-1793422931815 rect.text{fill:none;stroke-width:0;}#publish-mermaid-2-1793422931815 .icon-shape,#publish-mermaid-2-1793422931815 .image-shape{background-color:rgba(232,232,232, 0.8);text-align:center;}#publish-mermaid-2-1793422931815 .icon-shape p,#publish-mermaid-2-1793422931815 .image-shape p{background-color:rgba(232,232,232, 0.8);padding:2px;}#publish-mermaid-2-1793422931815 .icon-shape .label rect,#publish-mermaid-2-1793422931815 .image-shape .label rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#publish-mermaid-2-1793422931815 .label-icon{display:inline-block;height:1em;overflow:visible;vertical-align:-0.125em;}#publish-mermaid-2-1793422931815 .node .label-icon path{fill:currentColor;stroke:revert;stroke-width:revert;}#publish-mermaid-2-1793422931815 .node .neo-node{stroke:#9370DB;}#publish-mermaid-2-1793422931815 [data-look=\”neo\”].node rect,#publish-mermaid-2-1793422931815 [data-look=\”neo\”].cluster rect,#publish-mermaid-2-1793422931815 [data-look=\”neo\”].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-2-1793422931815 [data-look=\”neo\”].swimlane.cluster rect{filter:none;}#publish-mermaid-2-1793422931815 [data-look=\”neo\”].node path{stroke:#9370DB;stroke-width:1px;}#publish-mermaid-2-1793422931815 [data-look=\”neo\”].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-2-1793422931815 [data-look=\”neo\”].node .neo-line path{stroke:#9370DB;filter:none;}#publish-mermaid-2-1793422931815 [data-look=\”neo\”].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-2-1793422931815 [data-look=\”neo\”].node circle .state-start{fill:#000000;}#publish-mermaid-2-1793422931815 [data-look=\”neo\”].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-2-1793422931815 [data-look=\”neo\”].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-2-1793422931815 :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

执行 display mirror-session 命令

系统返回会话信息

会话ID

源端口列表

目的端口

会话状态

此流程图展示了查看镜像会话命令的执行过程和返回的关键信息。

4.2 删除镜像会话

当镜像会话不再需要时，可以使用 undo mirror-session 命令删除，释放相关资源。

system-view
# 删除镜像会话 1
undo mirror-session 1

五、 常见问题与最佳实践：让镜像更高效

5.1 常见配置错误

#publish-mermaid-3-1793422931858{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#publish-mermaid-3-1793422931858 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#publish-mermaid-3-1793422931858 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#publish-mermaid-3-1793422931858 .error-icon{fill:#552222;}#publish-mermaid-3-1793422931858 .error-text{fill:#552222;stroke:#552222;}#publish-mermaid-3-1793422931858 .edge-thickness-normal{stroke-width:1px;}#publish-mermaid-3-1793422931858 .edge-thickness-thick{stroke-width:3.5px;}#publish-mermaid-3-1793422931858 .edge-pattern-solid{stroke-dasharray:0;}#publish-mermaid-3-1793422931858 .edge-thickness-invisible{stroke-width:0;fill:none;}#publish-mermaid-3-1793422931858 .edge-pattern-dashed{stroke-dasharray:3;}#publish-mermaid-3-1793422931858 .edge-pattern-dotted{stroke-dasharray:2;}#publish-mermaid-3-1793422931858 .marker{fill:#333333;stroke:#333333;}#publish-mermaid-3-1793422931858 .marker.cross{stroke:#333333;}#publish-mermaid-3-1793422931858 svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#publish-mermaid-3-1793422931858 p{margin:0;}#publish-mermaid-3-1793422931858 defs [id$=\”-barbEnd\”]{fill:#333333;stroke:#333333;}#publish-mermaid-3-1793422931858 g.stateGroup text{fill:#9370DB;stroke:none;font-size:10px;}#publish-mermaid-3-1793422931858 g.stateGroup text{fill:#333;stroke:none;font-size:10px;}#publish-mermaid-3-1793422931858 g.stateGroup .state-title{font-weight:bolder;fill:#131300;}#publish-mermaid-3-1793422931858 g.stateGroup rect{fill:#ECECFF;stroke:#9370DB;}#publish-mermaid-3-1793422931858 g.stateGroup line{stroke:#333333;stroke-width:1;}#publish-mermaid-3-1793422931858 .transition{stroke:#333333;stroke-width:1;fill:none;}#publish-mermaid-3-1793422931858 .stateGroup .composit{fill:white;border-bottom:1px;}#publish-mermaid-3-1793422931858 .stateGroup .alt-composit{fill:#e0e0e0;border-bottom:1px;}#publish-mermaid-3-1793422931858 .state-note{stroke:#aaaa33;fill:#fff5ad;}#publish-mermaid-3-1793422931858 .state-note text{fill:black;stroke:none;font-size:10px;}#publish-mermaid-3-1793422931858 .stateLabel .box{stroke:none;stroke-width:0;fill:#ECECFF;opacity:0.5;}#publish-mermaid-3-1793422931858 .edgeLabel .label rect{fill:#ECECFF;opacity:0.5;}#publish-mermaid-3-1793422931858 .edgeLabel{background-color:rgba(232,232,232, 0.8);text-align:center;}#publish-mermaid-3-1793422931858 .edgeLabel p{background-color:rgba(232,232,232, 0.8);}#publish-mermaid-3-1793422931858 .edgeLabel rect{opacity:0.5;background-color:rgba(232,232,232, 0.8);fill:rgba(232,232,232, 0.8);}#publish-mermaid-3-1793422931858 .edgeLabel .label text{fill:#333;}#publish-mermaid-3-1793422931858 .label div .edgeLabel{color:#333;}#publish-mermaid-3-1793422931858 .stateLabel text{fill:#131300;font-size:10px;font-weight:bold;}#publish-mermaid-3-1793422931858 .node circle.state-start{fill:#333333;stroke:#333333;}#publish-mermaid-3-1793422931858 .node .fork-join{fill:#333333;stroke:#333333;}#publish-mermaid-3-1793422931858 .node circle.state-end{fill:#9370DB;stroke:white;stroke-width:1.5;}#publish-mermaid-3-1793422931858 .end-state-inner{fill:white;stroke-width:1.5;}#publish-mermaid-3-1793422931858 .node rect{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#publish-mermaid-3-1793422931858 .node polygon{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#publish-mermaid-3-1793422931858 [id$=\”-barbEnd\”]{fill:#333333;}#publish-mermaid-3-1793422931858 .statediagram-cluster rect{fill:#ECECFF;stroke:#9370DB;stroke-width:1px;}#publish-mermaid-3-1793422931858 .cluster-label,#publish-mermaid-3-1793422931858 .nodeLabel{color:#131300;}#publish-mermaid-3-1793422931858 .statediagram-cluster rect.outer{rx:5px;ry:5px;}#publish-mermaid-3-1793422931858 .statediagram-state .divider{stroke:#9370DB;}#publish-mermaid-3-1793422931858 .statediagram-state .title-state{rx:5px;ry:5px;}#publish-mermaid-3-1793422931858 .statediagram-cluster.statediagram-cluster .inner{fill:white;}#publish-mermaid-3-1793422931858 .statediagram-cluster.statediagram-cluster-alt .inner{fill:#f0f0f0;}#publish-mermaid-3-1793422931858 .statediagram-cluster .inner{rx:0;ry:0;}#publish-mermaid-3-1793422931858 .statediagram-state rect.basic{rx:5px;ry:5px;}#publish-mermaid-3-1793422931858 .statediagram-state rect.divider{stroke-dasharray:10,10;fill:#f0f0f0;}#publish-mermaid-3-1793422931858 .note-edge{stroke-dasharray:5;}#publish-mermaid-3-1793422931858 .statediagram-note rect{fill:#fff5ad;stroke:#aaaa33;stroke-width:1px;rx:0;ry:0;}#publish-mermaid-3-1793422931858 .statediagram-note rect{fill:#fff5ad;stroke:#aaaa33;stroke-width:1px;rx:0;ry:0;}#publish-mermaid-3-1793422931858 .statediagram-note text{fill:black;}#publish-mermaid-3-1793422931858 .statediagram-note .nodeLabel{color:black;}#publish-mermaid-3-1793422931858 .statediagram .edgeLabel{color:red;}#publish-mermaid-3-1793422931858 [id$=\”-dependencyStart\”],#publish-mermaid-3-1793422931858 [id$=\”-dependencyEnd\”]{fill:#333333;stroke:#333333;stroke-width:1;}#publish-mermaid-3-1793422931858 .statediagramTitleText{text-anchor:middle;font-size:18px;fill:#333;}#publish-mermaid-3-1793422931858 [data-look=\”neo\”].statediagram-cluster rect{fill:#ECECFF;stroke:#9370DB;stroke-width:1;}#publish-mermaid-3-1793422931858 [data-look=\”neo\”].statediagram-cluster rect.outer{rx:5px;ry:5px;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-3-1793422931858 .node .neo-node{stroke:#9370DB;}#publish-mermaid-3-1793422931858 [data-look=\”neo\”].node rect,#publish-mermaid-3-1793422931858 [data-look=\”neo\”].cluster rect,#publish-mermaid-3-1793422931858 [data-look=\”neo\”].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-3-1793422931858 [data-look=\”neo\”].swimlane.cluster rect{filter:none;}#publish-mermaid-3-1793422931858 [data-look=\”neo\”].node path{stroke:#9370DB;stroke-width:1px;}#publish-mermaid-3-1793422931858 [data-look=\”neo\”].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-3-1793422931858 [data-look=\”neo\”].node .neo-line path{stroke:#9370DB;filter:none;}#publish-mermaid-3-1793422931858 [data-look=\”neo\”].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-3-1793422931858 [data-look=\”neo\”].node circle .state-start{fill:#000000;}#publish-mermaid-3-1793422931858 [data-look=\”neo\”].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-3-1793422931858 [data-look=\”neo\”].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-3-1793422931858 :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}

配置状态

成功状态：配置正确

失败状态：目的端口模式错误

或

网络不通

失败状态

修正配置：检查并修正配置

修正配置

成功状态

：删除会话

该状态图描述了镜像会话从配置到成功或失败的状态转换过程。

5.2 性能影响与优化

镜像大量高带宽端口的流量可能会对交换机的CPU和目的端口的处理能力造成压力。建议：

• 仅镜像必要的流量。
• 使用高性能的分析设备作为目的端口。
• 监控目的端口的负载，避免因分析设备处理能力不足导致丢包。

5.3 最佳实践总结

遵循以下最佳实践可以确保端口镜像的有效性和稳定性。

#publish-mermaid-4-1793422931923{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#publish-mermaid-4-1793422931923 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#publish-mermaid-4-1793422931923 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#publish-mermaid-4-1793422931923 .error-icon{fill:#552222;}#publish-mermaid-4-1793422931923 .error-text{fill:#552222;stroke:#552222;}#publish-mermaid-4-1793422931923 .edge-thickness-normal{stroke-width:1px;}#publish-mermaid-4-1793422931923 .edge-thickness-thick{stroke-width:3.5px;}#publish-mermaid-4-1793422931923 .edge-pattern-solid{stroke-dasharray:0;}#publish-mermaid-4-1793422931923 .edge-thickness-invisible{stroke-width:0;fill:none;}#publish-mermaid-4-1793422931923 .edge-pattern-dashed{stroke-dasharray:3;}#publish-mermaid-4-1793422931923 .edge-pattern-dotted{stroke-dasharray:2;}#publish-mermaid-4-1793422931923 .marker{fill:#333333;stroke:#333333;}#publish-mermaid-4-1793422931923 .marker.cross{stroke:#333333;}#publish-mermaid-4-1793422931923 svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#publish-mermaid-4-1793422931923 p{margin:0;}#publish-mermaid-4-1793422931923 .pieCircle{stroke:black;stroke-width:2px;opacity:0.7;}#publish-mermaid-4-1793422931923 .pieCircle.highlighted{scale:1.05;opacity:1;}#publish-mermaid-4-1793422931923 .pieCircle.highlightedOnHover:hover{transition-duration:250ms;scale:1.05;opacity:1;}#publish-mermaid-4-1793422931923 .pieOuterCircle{stroke:black;stroke-width:2px;fill:none;}#publish-mermaid-4-1793422931923 .pieTitleText{text-anchor:middle;font-size:25px;fill:black;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}#publish-mermaid-4-1793422931923 .slice{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;fill:#333;font-size:17px;}#publish-mermaid-4-1793422931923 .legend text{fill:black;font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:17px;}#publish-mermaid-4-1793422931923 .node .neo-node{stroke:#9370DB;}#publish-mermaid-4-1793422931923 [data-look=\”neo\”].node rect,#publish-mermaid-4-1793422931923 [data-look=\”neo\”].cluster rect,#publish-mermaid-4-1793422931923 [data-look=\”neo\”].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-4-1793422931923 [data-look=\”neo\”].swimlane.cluster rect{filter:none;}#publish-mermaid-4-1793422931923 [data-look=\”neo\”].node path{stroke:#9370DB;stroke-width:1px;}#publish-mermaid-4-1793422931923 [data-look=\”neo\”].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-4-1793422931923 [data-look=\”neo\”].node .neo-line path{stroke:#9370DB;filter:none;}#publish-mermaid-4-1793422931923 [data-look=\”neo\”].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-4-1793422931923 [data-look=\”neo\”].node circle .state-start{fill:#000000;}#publish-mermaid-4-1793422931923 [data-look=\”neo\”].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-4-1793422931923 [data-look=\”neo\”].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-4-1793422931923 :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}30%25%25%20%端口镜像最佳实践占比明确监控目标选择合适的镜像类型监控目的端口负载及时清理镜像会话

此饼图直观地展示了各项最佳实践的重要性占比。

六、 案例分析：通过镜像定位 ARP 攻击

6.1 故障现象

某部门网络频繁出现 IP 冲突提示，导致部分主机无法正常上网。

6.2 使用镜像定位问题

网络管理员怀疑是 ARP 攻击，决定在接入交换机（S5735）上对故障 VLAN 的上行端口进行镜像，将流量引至一台 PC 上的 Wireshark 进行分析。

管理员Wireshark(分析PC)交换机(S5735)主机A管理员Wireshark(分析PC)交换机(S5735)主机A#publish-mermaid-5-1793422931930{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;fill:#333;}@keyframes edge-animation-frame{from{stroke-dashoffset:0;}}@keyframes dash{to{stroke-dashoffset:0;}}#publish-mermaid-5-1793422931930 .edge-animation-slow{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 50s linear infinite;stroke-linecap:round;}#publish-mermaid-5-1793422931930 .edge-animation-fast{stroke-dasharray:9,5!important;stroke-dashoffset:900;animation:dash 20s linear infinite;stroke-linecap:round;}#publish-mermaid-5-1793422931930 .error-icon{fill:#552222;}#publish-mermaid-5-1793422931930 .error-text{fill:#552222;stroke:#552222;}#publish-mermaid-5-1793422931930 .edge-thickness-normal{stroke-width:1px;}#publish-mermaid-5-1793422931930 .edge-thickness-thick{stroke-width:3.5px;}#publish-mermaid-5-1793422931930 .edge-pattern-solid{stroke-dasharray:0;}#publish-mermaid-5-1793422931930 .edge-thickness-invisible{stroke-width:0;fill:none;}#publish-mermaid-5-1793422931930 .edge-pattern-dashed{stroke-dasharray:3;}#publish-mermaid-5-1793422931930 .edge-pattern-dotted{stroke-dasharray:2;}#publish-mermaid-5-1793422931930 .marker{fill:#333333;stroke:#333333;}#publish-mermaid-5-1793422931930 .marker.cross{stroke:#333333;}#publish-mermaid-5-1793422931930 svg{font-family:\”trebuchet ms\”,verdana,arial,sans-serif;font-size:16px;}#publish-mermaid-5-1793422931930 p{margin:0;}#publish-mermaid-5-1793422931930 .actor{stroke:#9370DB;fill:#ECECFF;stroke-width:1;}#publish-mermaid-5-1793422931930 rect.actor.outer-path[data-look=\”neo\”]{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-5-1793422931930 rect.note[data-look=\”neo\”]{stroke:#aaaa33;fill:#fff5ad;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-5-1793422931930 text.actor>tspan{fill:black;stroke:none;}#publish-mermaid-5-1793422931930 .actor-line{stroke:#9370DB;}#publish-mermaid-5-1793422931930 .innerArc{stroke-width:1.5;stroke-dasharray:none;}#publish-mermaid-5-1793422931930 .messageLine0{stroke-width:1.5;stroke-dasharray:none;stroke:#333;}#publish-mermaid-5-1793422931930 .messageLine1{stroke-width:1.5;stroke-dasharray:2,2;stroke:#333;}#publish-mermaid-5-1793422931930 [id$=\”-arrowhead\”] path{fill:#333;stroke:#333;}#publish-mermaid-5-1793422931930 .sequenceNumber{fill:white;}#publish-mermaid-5-1793422931930 [id$=\”-sequencenumber\”]{fill:#333;}#publish-mermaid-5-1793422931930 [id$=\”-crosshead\”] path{fill:#333;stroke:#333;}#publish-mermaid-5-1793422931930 .messageText{fill:#333;stroke:none;}#publish-mermaid-5-1793422931930 .labelBox{stroke:#9370DB;fill:#ECECFF;filter:none;}#publish-mermaid-5-1793422931930 .labelText,#publish-mermaid-5-1793422931930 .labelText>tspan{fill:black;stroke:none;}#publish-mermaid-5-1793422931930 .loopText,#publish-mermaid-5-1793422931930 .loopText>tspan{fill:black;stroke:none;}#publish-mermaid-5-1793422931930 .sectionTitle,#publish-mermaid-5-1793422931930 .sectionTitle>tspan{fill:black;stroke:none;}#publish-mermaid-5-1793422931930 .loopLine{stroke-width:2px;stroke-dasharray:2,2;stroke:#9370DB;fill:#9370DB;}#publish-mermaid-5-1793422931930 .note{stroke:#aaaa33;fill:#fff5ad;}#publish-mermaid-5-1793422931930 .noteText,#publish-mermaid-5-1793422931930 .noteText>tspan{fill:black;stroke:none;font-weight:normal;}#publish-mermaid-5-1793422931930 .activation0{fill:#f4f4f4;stroke:#666;}#publish-mermaid-5-1793422931930 .activation1{fill:#f4f4f4;stroke:#666;}#publish-mermaid-5-1793422931930 .activation2{fill:#f4f4f4;stroke:#666;}#publish-mermaid-5-1793422931930 .actorPopupMenu{position:absolute;}#publish-mermaid-5-1793422931930 .actorPopupMenuPanel{position:absolute;fill:#ECECFF;box-shadow:0px 8px 16px 0px rgba(0,0,0,0.2);filter:drop-shadow(3px 5px 2px rgb(0 0 0 / 0.4));}#publish-mermaid-5-1793422931930 .actor-man circle,#publish-mermaid-5-1793422931930 line{fill:#ECECFF;stroke-width:2px;}#publish-mermaid-5-1793422931930 g rect.rect{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));stroke:#9370DB;}#publish-mermaid-5-1793422931930 .node .neo-node{stroke:#9370DB;}#publish-mermaid-5-1793422931930 [data-look=\”neo\”].node rect,#publish-mermaid-5-1793422931930 [data-look=\”neo\”].cluster rect,#publish-mermaid-5-1793422931930 [data-look=\”neo\”].node polygon{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-5-1793422931930 [data-look=\”neo\”].swimlane.cluster rect{filter:none;}#publish-mermaid-5-1793422931930 [data-look=\”neo\”].node path{stroke:#9370DB;stroke-width:1px;}#publish-mermaid-5-1793422931930 [data-look=\”neo\”].node .outer-path{filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-5-1793422931930 [data-look=\”neo\”].node .neo-line path{stroke:#9370DB;filter:none;}#publish-mermaid-5-1793422931930 [data-look=\”neo\”].node circle{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-5-1793422931930 [data-look=\”neo\”].node circle .state-start{fill:#000000;}#publish-mermaid-5-1793422931930 [data-look=\”neo\”].icon-shape .icon{fill:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-5-1793422931930 [data-look=\”neo\”].icon-shape .icon-neo path{stroke:#9370DB;filter:drop-shadow(1px 2px 2px rgba(185, 185, 185, 1));}#publish-mermaid-5-1793422931930 :root{–mermaid-font-family:\”trebuchet ms\”,verdana,arial,sans-serif;}捕获并分析数据包正常数据流量镜像流量发现大量异常ARP请求

此时序图展示了流量从源主机到交换机，再到分析工具，最终由管理员发现问题的过程。

6.3 分析抓包数据

通过 Wireshark 分析镜像流量，发现网络中存在大量源 MAC 地址相同但目标 IP 地址不同的 ARP 请求，这是典型的 ARP 欺骗攻击特征。通过分析这些 ARP 报文，可以快速定位到发起攻击的主机，并采取隔离措施。

七、 总结

端口镜像是网络工程师的“透视眼”，尤其在华为 S5735 等企业级交换机上，其配置灵活、功能强大。掌握本地和远程镜像的配置方法，结合实际案例分析，能够显著提升网络故障的排查效率。在实际应用中，务必遵循最佳实践，合理规划镜像策略，才能让这项技术发挥最大价值，成为网络稳定运行的坚实保障。