Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

请问下,我使用mirror工具镜像流量,导致包量陡增? #2

Open
zorogong opened this issue May 28, 2018 · 1 comment
Open

Comments

@zorogong
Copy link

测试流程如下:
测试服务器A:10.0.0.3 用户请求
测试服务器B:10.0.0.4 mirror所在机器 单网卡
测试服务器C:172.17.122.172 用于接收镜像流量

(1)在服务器A上一直Ping 10.0.0.4
(2)服务器B:网卡enp0s31f6的mac地址为50:9a:4c:04:b0:a5 ,下一条mac为6c:b0:ce:bc:b3:75 ,我只镜像icmp的请求
./sbin/mirror -t 6c:b0:ce:bc:b3:75 -s 50:9a:4c:04:b0:a5 -x 172.17.122.172 -i enp0s31f6 -o enp0s31f6 -F 'icmp[0] == 8'
(2)在服务器B上抓包发现发送大量重复172.17.122.172,但是服务器A上请求频率很低,每秒一次

@zorogong
Copy link
Author

在服务器B上抓包结果如下:

[root@localhost ~]# head mylog -n 100
17:45:18.254111 50:9a:4c:04:b3:1d > 50:9a:4c:04:b0:a5, ethertype IPv4 (0x0800), length 98: 10.0.0.3 > 10.0.0.4: ICMP echo request, id 6361, seq 477, length 64
17:45:19.253984 50:9a:4c:04:b3:1d > 50:9a:4c:04:b0:a5, ethertype IPv4 (0x0800), length 98: 10.0.0.3 > 10.0.0.4: ICMP echo request, id 6361, seq 478, length 64
17:45:20.254079 50:9a:4c:04:b3:1d > 50:9a:4c:04:b0:a5, ethertype IPv4 (0x0800), length 98: 10.0.0.3 > 10.0.0.4: ICMP echo request, id 6361, seq 479, length 64
17:45:20.254247 50:9a:4c:04:b0:a5 > 6c:b0:ce:bc:b3:75, ethertype IPv4 (0x0800), length 98: 10.0.0.3 > 172.17.122.172: ICMP echo request, id 6361, seq 479, length 64
17:45:20.254260 50:9a:4c:04:b0:a5 > 6c:b0:ce:bc:b3:75, ethertype IPv4 (0x0800), length 98: 10.0.0.3 > 172.17.122.172: ICMP echo request, id 6361, seq 479, length 64
17:45:20.254267 50:9a:4c:04:b0:a5 > 6c:b0:ce:bc:b3:75, ethertype IPv4 (0x0800), length 98: 10.0.0.3 > 172.17.122.172: ICMP echo request, id 6361, seq 479, length 64
17:45:20.254272 50:9a:4c:04:b0:a5 > 6c:b0:ce:bc:b3:75, ethertype IPv4 (0x0800), length 98: 10.0.0.3 > 172.17.122.172: ICMP echo request, id 6361, seq 479, length 64
17:45:20.254277 50:9a:4c:04:b0:a5 > 6c:b0:ce:bc:b3:75, ethertype IPv4 (0x0800), length 98: 10.0.0.3 > 172.17.122.172: ICMP echo request, id 6361, seq 479, length 64
17:45:20.254283 50:9a:4c:04:b0:a5 > 6c:b0:ce:bc:b3:75, ethertype IPv4 (0x0800), length 98: 10.0.0.3 > 172.17.122.172: ICMP echo request, id 6361, seq 479, length 64
17:45:20.254289 50:9a:4c:04:b0:a5 > 6c:b0:ce:bc:b3:75, ethertype IPv4 (0x0800), length 98: 10.0.0.3 > 172.17.122.172: ICMP echo request, id 6361, seq 479, length 64
17:45:20.254294 50:9a:4c:04:b0:a5 > 6c:b0:ce:bc:b3:75, ethertype IPv4 (0x0800), length 98: 10.0.0.3 > 172.17.122.172: ICMP echo request, id 6361, seq 479, length 64
17:45:20.254299 50:9a:4c:04:b0:a5 > 6c:b0:ce:bc:b3:75, ethertype IPv4 (0x0800), length 98: 10.0.0.3 > 172.17.122.172: ICMP echo request, id 6361, seq 479, length 64
............
很多重复的包,但是从10.0.0.3到10.0.0.4的包量很少,每秒一个

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant