叁叁肆

这个世界会好吗

453篇博客

玩转Openvwitch第四站:Bridge和Mirror

叁叁肆2018-11-06 16:26

此文已由作者刘超授权网易云社区发布。

欢迎访问网易云社区,了解更多网易技术产品运营经验。


Mirror的数据表结构如下:



Mirror就是配置一个bridge,将某些包发给指定的mirrored ports


对于包的选择:

  • select_all,所有的包

  • select_dst_port

  • select_src_port

  • select_vlan


对于指定的目的:

  • output_port (SPAN Switched Port ANalyzer)

  • output_vlan (RSPAN Remote Switched Port ANalyzer)


SPAN

  • Source (SPAN) port -A port that is monitored with use of the SPAN feature.

  • Destination (SPAN) port -A port that monitors source ports, usually where a network analyzer is connected.




RSPAN

  • 被监控的流量不是发送到一个指定的端口,而是Flood给指定的VLAN 

  • 监听的端口不一定要在本地switch上,可以在指定的VLAN的任意switch上

  • S1 is a source switch

  • S2 and S3 are intermediate switches

  • S4 and S5 are destination switches. 

  • learning is disabled to enable flooding



我们来测试Mirror的SPAN和RSPAN




创建拓扑结构


ovs-vsctl add-br helloworld

ip link add first_br type veth peer name first_if
ip link add second_br type veth peer name second_if
ip link add third_br type veth peer name third_if

ovs-vsctl add-port ubuntu_br first_br
ovs-vsctl add-port ubuntu_br second_br -- set Port second_br tag=110
ovs-vsctl add-port helloworld second_if -- set Port second_if tag=110
ovs-vsctl add-port helloworld third_br -- set Port third_br tag=110




在first_br上面mirror所有进出vnet0的包


ovs-vsctl -- set bridge ubuntu_br mirrors=@m -- --id=@vnet0 get Port vnet0 -- --id=@first_br get Port first_br -- --id=@m create Mirror name=mirrorvnet0 select-dst-port=@vnet0 select-src-port=@vnet0 output-port=@first_br


监听first_if,并且从instance01里面ping 192.168.100.102



对进入vnet1的所有进出包,然而ouput到一个vlan 110


ovs-vsctl -- set bridge ubuntu_br mirrors=@m -- --id=@vnet1 get Port vnet1 -- --id=@m create Mirror name=mirrorvnet1 select-dst-port=@vnet1 select-src-port=@vnet1 output-vlan=110


在helloworld中也要配置从110来的,都output到vlan 110


ovs-vsctl -- set bridge helloworld mirrors=@m -- --id=@m create Mirror name=mirrorvlan select-vlan=110 output-vlan=110


Disable mac address learning for vlan 110


ovs-vsctl set bridge ubuntu_br flood-vlans=110

ovs-vsctl set bridge helloworld flood-vlans=110


监听third_if,并且从instance02里面ping 192.168.100.102



删除Mirror


查看ubuntu_br

ovs-vsctl list bridge ubuntu_br

清除里面的mirrors

ovs-vsctl clear Bridge ubuntu_br mirrors

清除flood_vlans

ovs-vsctl clear Bridge ubuntu_br flood_vlans

查看所有的Mirror

ovs-vsctl list Mirror

ovs-vsctl clear Bridge helloworld mirrors

ovs-vsctl clear Bridge helloworld flood_vlans


免费体验云安全(易盾)内容安全、验证码等服务

11.1—11.15云计算基础服务全场5折起

更多网易技术、产品、运营经验分享请点击