Mirroring Inbound TCP Traffic to a Single Network Interface
Solution Architecture
- Set mirror source to network-interface-s of ECS-source, indicating that the inbound TCP traffic on this network interface needs to be mirrored.
- Set mirror target to network-interface-t of ECS-target, indicating that the inbound TCP traffic on network-interface-s is mirrored to network-interface-t.
- Associate the mirror filter that has a rule for accepting inbound TCP traffic with the mirror session.
Notes and Constraints
Resource Planning
The following resource details are only for your reference. You can modify them if needed.
Resource |
Quantity |
Description |
---|---|---|
VPC and subnet |
1 |
|
ECS |
3 |
Configure the ECSs as follows:
|
EIP |
1 |
|
Mirror filter |
1 |
|
Mirror session |
1 |
|
Direction |
Action |
Type |
Protocol & Port |
Source or Destination |
Description |
---|---|---|---|---|---|
Inbound |
Allow |
IPv4 |
TCP: 22 |
Source: 0.0.0.0/0 |
Allows remote logins to Linux ECSs over SSH port 22. |
Inbound |
Allow |
IPv4 |
TCP: 3389 |
Source: 0.0.0.0/0 |
Allows remote logins to Windows ECSs over RDP port 3389. |
Inbound |
Allow |
IPv4 |
All |
Source: current security group (Sg-X) |
Allows the ECSs in this security group to communicate with each other using IPv4 addresses. |
Inbound |
Allow |
IPv6 |
All |
Source: current security group (Sg-X) |
Allows the ECSs in this security group to communicate with each other using IPv6 addresses. |
Outbound |
Allow |
IPv4 |
All |
Destination: 0.0.0.0/0 |
Allows ECSs in this security group to access the Internet using IPv4 addresses. |
Outbound |
Allow |
IPv6 |
All |
Destination: ::/0 |
Allows ECSs in this security group to access the Internet using IPv6 addresses. |
In this example, Source is set to 0.0.0.0/0, which allows any IP address to remotely log in to ECSs in this security group. To ensure security, you are advised to set Source to a specific IP address, for example, the IP address of your local PC.
Direction |
Action |
Type |
Protocol & Port |
Source |
Description |
---|---|---|---|---|---|
Inbound |
Allow |
IPv4 |
TCP: 1234 |
Private IP address of the ECS that accesses the mirror source. In this example, the private IP address of ECS-test is used: 192.168.0.161/32 |
Allows TCP packets from ECS-test to ECS-source over port 1234. |
Direction |
Action |
Type |
Protocol & Port |
Source |
Description |
---|---|---|---|---|---|
Inbound |
Allow |
IPv4 |
UDP: 4789 |
Private IP address of the mirror source. In this example, the private IP address of ECS-source is used: 192.168.0.230/32 |
Allows UDP packets encapsulated by ECS-source to access ECS-target over port 4789. |
Direction |
Priority |
Protocol |
Action |
Type |
Source |
Source Port Range |
Destination |
Destination Port Range |
---|---|---|---|---|---|---|---|---|
Inbound |
1 |
TCP |
Accept |
IPv4 |
Source of packets. In this example, the private IP address of ECS-test is used: 192.168.0.161/32 |
All |
Destination of packets. In this example, the private IP address of ECS-source is used: 192.168.0.230/32 |
In this example, port 1234 of ECS-source is used. 1234-1234 |
Procedure
Figure 2 shows the procedure required to mirror inbound TCP traffic to a single network interface.
Step 1: Create Cloud Resources
- Create a VPC and subnet.
For details, see Creating a VPC and Subnet.
- Create three ECSs.
For details, see Purchasing a Custom ECS.
- Assign an EIP.
For details, see Assigning an EIP.
Step 2: Create a Mirror Filter and a Mirror Session
- Create a mirror filter.
For details, see Creating a Mirror Filter.
- Create a mirror session, and associate the mirror filter, mirror source, and mirror target with this mirror session.
For details, see Creating a Mirror Session.
Step 3: Install Netcat (nc) to Simulate Traffic
The nc utility reads and writes data across network connections using the TCP or UDP protocol. It is usually used to test ports for accessibility. You need to install nc on both ECS-source and ECS-test.
- Install nc on ECS-source.
- Bind the EIP to ECS-source to connect to the Internet for downloading the nc utility.
For details, see Binding an EIP to an ECS.
- Remotely log in to ECS-source.
For details, see How Do I Log In to My ECS?.
- Run the following commands in sequence to install nc:
Information similar to the following is displayed:
[root@ecs-source ~]# sudo yum update HCE 2.0 base 55 MB/s | 6.1 MB 00:00 HCE 2.0 updates 98 MB/s | 14 MB 00:00 Last metadata expiration check: 0:00:01 ago on Tue 10 Sep 2024 05:54:28 PM CST. Dependencies resolved. Nothing to do. Complete!
sudo yum install nc
If information similar to the following is displayed, enter y as prompted and press Enter:[root@ecs-source ~]# sudo yum install nc Last metadata expiration check: 0:00:12 ago on Tue 10 Sep 2024 05:54:28 PM CST. Dependencies resolved. ... Install 2 Packages Total download size: 6.1 M Installed size: 25 M Is this ok [y/N]: y Downloading Packages: ... Importing GPG key 0xA8DEF926: Userid : "HCE <support@huaweicloud.com>" Fingerprint: C1BA 9CD4 9D03 A206 E241 F176 28DA 5B77 A8DE F926 From : http://repo.huaweicloud.com/hce/2.0/updates/RPM-GPG-KEY-HCE-2 Is this ok [y/N]: y ... Installed: libssh2-1.10.0-2.r10.hce2.x86_64 nmap-2:7.92-2.r4.hce2.x86_64 Complete!
- Unbind the EIP from ECS-source after nc is installed.
For details, see Unbinding an EIP.
- Bind the EIP to ECS-source to connect to the Internet for downloading the nc utility.
- Repeat 1.a to 1.d on ECS-test.
- Release the EIP.
For details, see Unbinding an EIP. If you do not release the EIP, the EIP will continue to be billed.
Step 3: Check Whether the Mirror Session Takes Effect
- Establish a TCP connection between ECS-source and ECS-test.
Send TCP packets from ECS-test to ECS-source and check whether ECS-source can receive the packets.
- Run the following command on ECS-source to listen to its port 1234:
nc -l Listening port of mirror source ECS-source
Example command:
nc -l 1234
If the command output is empty, the port is opened for listening.
- Run the following command on ECS-test to establish a TCP connection between ECS-source and ECS-test:
nc Private IP address of the mirror source ECS-source Listening port of the mirror source ECS-source
Example command:
nc 192.168.0.230 1234
The command output is empty. Enter any information (for example, hello) on ECS-test and press Enter to check whether the TCP connection is successfully established.[root@ecs-test ~]# nc 192.168.0.230 1234 hello
- Check whether ECS-source can receive information from ECS-test.
If information similar to the following is displayed, the TCP connection is successfully established.
[root@ecs-source ~]# nc -l 1234 hello
- Run the following command on ECS-source to listen to its port 1234:
- Check whether the inbound packets on ECS-source can be mirrored to ECS-target.
When ECS-test sends a TCP packet to ECS-source, use TCPDUMP to check whether ECS-target can receive the packet. If ECS-target received the packet, the mirror session takes effect.
- Remotely log in to ECS-target.
For details, see How Do I Log In to My ECS?.
- Run the following command on ECS-target to view its network interface name:
ifconfig
Information similar to the following is displayed. In this example, the network interface of the mirror target is eth0.[root@ecs-target ~]# ifconfig eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500 inet 192.168.0.164 netmask 255.255.255.0 broadcast 192.168.0.255 inet6 fe80::f816:3eff:fe7e:d67a prefixlen 64 scopeid 0x20<link> ether fa:16:3e:7e:d6:7a txqueuelen 1000 (Ethernet) RX packets 29043 bytes 32268398 (30.7 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 13811 bytes 3961116 (3.7 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 ...
- Run the following command on ECS-target to check its received packets:
tcpdump -i Network interface name of mirror source udp port 4789 -nne
Example command:
tcpdump -i eth0 udp port 4789 -nne
Information similar to the following is displayed:[root@ecs-target ~]# tcpdump -i eth0 udp port 4789 -nne dropped privs to tcpdump tcpdump: verbose output suppressed, use -v[v]... for full protocol decode listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
- Enter any information (for example, 12345) on ECS-test and press Enter to send TCP packets to ECS-source.
Information similar to the following is displayed:
[root@ecs-test ~]# nc 192.168.0.230 1234 hello 12345
- Check whether ECS-source can receive information from ECS-test.
If information similar to the following is displayed, ECS-source can receive information from ECS-test:
[root@ecs-source ~]# nc -l 1234 hello 12345
- Check whether ECS-target can receive packets.
Information similar to the following is displayed. You can view the packet of 12345 sent by ECS-test after using TCPDUMP. vni 1 is the identifier of the mirror session, indicating that ECS-target can receive the packet through the mirror session. The packet content has two parts. For details, see Table 6.
[root@ecs-target ~]# tcpdump -i eth0 udp port 4789 -nne dropped privs to tcpdump tcpdump: verbose output suppressed, use -v[v]... for full protocol decode listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes 19:12:25.839624 fa:16:3e:d1:6b:5d > fa:16:3e:7e:d6:7a, ethertype IPv4 (0x0800), length 122: 192.168.0.230.32838 > 192.168.0.164.4789: VXLAN, flags [I] (0x08), vni 1 fa:16:3e:7e:d6:77 > fa:16:3e:7e:d6:bc, ethertype IPv4 (0x0800), length 72: 192.168.0.161.38944 > 192.168.0.230.1234: Flags [P.], seq 2063075043:2063075049, ack 1116663338, win 502, options [nop,nop,TS val 969673134 ecr 605179348], length 6
Table 6 Packet description Packet Example
Packet Description
19:12:25.839624 fa:16:3e:d1:6b:5d > fa:16:3e:7e:d6:7a, ethertype IPv4 (0x0800), length 122: 192.168.0.230.32838 > 192.168.0.164.4789: VXLAN, flags [I] (0x08), vni 1
VXLAN packet encapsulated by Traffic Mirroring. Packet format:
<Timestamp><SMacAddr><DMacAddr><EthernetType><Length><Sip><Sport><Dip><Dport><VXLAN Flags><VNI>
Fields in the encapsulated packet:- Timestamp: Time when a packet is obtained. It is generated by TCPDUMP.
- SMacAddr: MAC address of the source instance of VXLAN packets. In this example, it is the MAC address of the gateway instance.
- DMacAddr: MAC address of the target instance of VXLAN packets. In this example, it is the MAC address of the mirror target instance.
- EthernetType: indicates the Ethernet type of a packet. 0x0800 indicates that the protocol is IPv4.
- Length: packet length
- Sip: Mirror source address
- Sport: Mirror source port
- Dip: Mirror target address
- Dport: Mirror target port, which is usually port 4789 that receives VXLAN packets
- VXLAN Flags: The value is usually 0x08, indicating a VXLAN packet.
- VNI: VXLAN network identifier of a mirror session
fa:16:3e:7e:d6:77 > fa:16:3e:7e:d6:bc, ethertype IPv4 (0x0800), length 72: 192.168.0.161.38944 > 192.168.0.230.1234: Flags [P.], seq 2063075043:2063075049, ack 1116663338, win 502, options [nop,nop,TS val 969673134 ecr 605179348], length 6
Original packet
The original packet field is general network knowledge and is not described in detail herein.
- Remotely log in to ECS-target.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbot