■Cisco C2970にローカルミラーポート(SPAN)を設定してみる。 [Linux2]側にIP設定が要るのか要らないのか気になったので、試してみる。 結果的には、モニターポートに接続したinterfaceにはIP設定は不要でDHCPに関するパケットも流れない。 SWの設定がクリアされてしまうなどの事態を想定するなら、[Linux2]側には同セグメントの別のIPアドレスを設定する方が良い。 $ echo "[Linux1]";lsb_release -d Description: Debian GNU/Linux 8.3 (jessie) $ echo "[Linux2]";lsb_release -d [Linux2] Description: Debian GNU/Linux 8.3 (jessie) Switch>enable Switch#show version | include ^Cisco Cisco IOS Software, C2970 Software (C2970-LANBASE-M), Version 12.2(44)SE6, RELEASE SOFTWARE (fc1) ■初期化されたC2970をinterface単位でミラーする設定に変更する単純なイメージ図。 $ echo "[Linux1-eth1]<-->[Gi-0/23]<-- SPAN -->[Gi-0/24]-->[eth1-Linux2]" | \ graph-easy --dot | dot -T png -o localspan.png
■[Gi-0/23]から[Gi-0/24]へのSPAN(ローカル)の設定 [Linux1]側が1G、[Linux2]側が100Mリンクのため、 [Linux1]側に接続する[Ge0/23]を100M固定とした。 configure monitor session 1 source interface GigabitEthernet 0/23 both monitor session 1 destination interface GigabitEthernet 0/24 interface vlan 1 ip address 172.16.16.254 255.255.255.0 no shutdown interface GigabitEthernet 0/23 speed 100 no shutdown interface GigabitEthernet 0/24 no shutdown end ■モニタポートは設定した通り Switch#show monitor Session 1 --------- Type : Local Session Source Ports : Both : Gi0/23 Destination Ports : Gi0/24 Encapsulation : Native Ingress : Disabled ■[Gi-0/23]はVLAN 1に所属している。 Switch#show vlan id 1 VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Gi0/1, Gi0/2, Gi0/3, Gi0/4 Gi0/5, Gi0/6, Gi0/7, Gi0/8 Gi0/9, Gi0/10, Gi0/11, Gi0/12 Gi0/13, Gi0/14, Gi0/15, Gi0/16 Gi0/17, Gi0/18, Gi0/19, Gi0/20 Gi0/21, Gi0/22, Gi0/23 VLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2 ---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------ 1 enet 100001 1500 - - - - - 0 0 Remote SPAN VLAN ---------------- Disabled Primary Secondary Type Ports ------- --------- ----------------- ------------------------------------------ ■各interfaceは100Mでリンクアップ、[Gi-0/24]はモニタポート。 Switch#show interfaces status | include 2[234] Gi0/22 connected 1 a-full a-100 10/100/1000BaseTX Gi0/23 connected 1 a-full 100 10/100/1000BaseTX Gi0/24 monitoring 1 a-full a-100 10/100/1000BaseTX ■[Linux1]のMACアドレスは、[XX:XX:XX:XX:10:ca]、[Linux2]のMACアドレスは[XX:XX:XX:XX:c2:e3] $ echo "[Linux1]"; \ ip a list eth1 | grep -v inet6 | \ sed -e 's/ [0-9a-e][0-9a-e]:[0-9a-e][0-9a-e]:[0-9a-e][0-9a-e]:[0-9a-e][0-9a-e]:/ XX:XX:XX:XX:/' [Linux1] 2: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether XX:XX:XX:XX:10:ca brd ff:ff:ff:ff:ff:ff inet 172.16.16.88/24 brd 172.16.16.255 scope global eth1 valid_lft forever preferred_lft forever $ echo "[Linux2]"; \ ip a list eth1 | grep -v inet6 \ sed -e 's/ [0-9a-e][0-9a-e]:[0-9a-e][0-9a-e]:[0-9a-e][0-9a-e]:[0-9a-e][0-9a-e]:/ XX:XX:XX:XX:/' [Linux2] 5: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether XX:XX:XX:XX:c2:e3 brd ff:ff:ff:ff:ff:ff valid_lft forever preferred_lft forever ■pingを双方向で送信 Switch#ping 172.16.16.88 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 172.16.16.88, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/203/1006 ms $ ping -c 3 172.16.16.88 PING 172.16.16.88 (172.16.16.88) 56(84) bytes of data. 64 bytes from 172.16.16.88: icmp_seq=1 ttl=64 time=0.157 ms 64 bytes from 172.16.16.88: icmp_seq=2 ttl=64 time=0.076 ms 64 bytes from 172.16.16.88: icmp_seq=3 ttl=64 time=0.079 ms --- 172.16.16.88 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2000ms rtt min/avg/max/mdev = 0.076/0.104/0.157/0.037 ms ■pingによりMACアドレスを学習しているはずなので確認 [10:ca]は[Linux1-eth1]と一致 Switch#show ip arp Protocol Address Age (min) Hardware Addr Type Interface Internet 172.16.16.254 - XXXX.XXXX.fcc0 ARPA Vlan1 Internet 172.16.16.88 1 XXXX.XXXX.10ca ARPA Vlan1 $ echo "[Linux1]";sudo arp -an | grep eth1 [Linux1] ? (172.16.16.254) at XX:XX:XX:XX:fc:c0 [ether] on eth1 ■L2のブロードキャスト範囲内なので、tcpdumpでキャプチャ出来るはず。 ※CiscoのL2SWからのブロードキャストは[255.255.255.255]になってる？ $ echo "[Linux2]";sudo tcpdump -i eth1 [Linux2] $ echo "[Linux1]-->[Gi0/23]";sudo ping -c 2 -b 172.16.16.255 [Linux1]-->[Gi0/23] WARNING: pinging broadcast address PING 172.16.16.255 (172.16.16.255) 56(84) bytes of data. 64 bytes from 172.16.16.254: icmp_seq=1 ttl=255 time=0.429 ms 64 bytes from 172.16.16.254: icmp_seq=2 ttl=255 time=0.424 ms --- 172.16.16.255 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 999ms rtt min/avg/max/mdev = 0.424/0.426/0.429/0.020 ms ■ブロードキャストpingの実行結果 13:58:06.137331 IP 172.16.16.88 > 172.16.16.255: ICMP echo request, id 29933, seq 1, length 64 13:58:06.137639 IP 172.16.16.254 > 172.16.16.88: ICMP echo reply, id 29933, seq 1, length 64 13:58:07.136898 IP 172.16.16.88 > 172.16.16.255: ICMP echo request, id 29933, seq 2, length 64 13:58:07.137217 IP 172.16.16.254 > 172.16.16.88: ICMP echo reply, id 29933, seq 2, length 64 ■普通のping $ echo "[Linux1]-->[Gi0/23]";sudo ping -c 2 172.16.16.254 [Linux1]-->[Gi0/23] PING 172.16.16.254 (172.16.16.254) 56(84) bytes of data. 64 bytes from 172.16.16.254: icmp_seq=1 ttl=255 time=0.432 ms 64 bytes from 172.16.16.254: icmp_seq=2 ttl=255 time=0.421 ms --- 172.16.16.254 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 999ms rtt min/avg/max/mdev = 0.421/0.426/0.432/0.021 ms 13:59:31.701636 IP 172.16.16.88 > 172.16.16.254: ICMP echo request, id 29936, seq 1, length 64 13:59:31.701999 IP 172.16.16.254 > 172.16.16.88: ICMP echo reply, id 29936, seq 1, length 64 13:59:32.700993 IP 172.16.16.88 > 172.16.16.254: ICMP echo request, id 29936, seq 2, length 64 13:59:32.701228 IP 172.16.16.254 > 172.16.16.88: ICMP echo reply, id 29936, seq 2, length 64 ■tsharkでも確認出来る。 $ echo "[Linux2]";sudo tshark -i 3 [Linux2] 23 25.590468 172.16.16.254 -> 172.16.16.88 ICMP 114 Echo (ping) request id=0x0009, seq=0/0, ttl=255 24 25.590604 172.16.16.88 -> 172.16.16.254 ICMP 114 Echo (ping) reply id=0x0009, seq=0/0, ttl=64 (request in 23) 25 25.592127 172.16.16.254 -> 172.16.16.88 ICMP 114 Echo (ping) request id=0x0009, seq=1/256, ttl=255 26 25.592220 172.16.16.88 -> 172.16.16.254 ICMP 114 Echo (ping) reply id=0x0009, seq=1/256, ttl=64 (request in 25) 27 25.594272 172.16.16.254 -> 172.16.16.88 ICMP 114 Echo (ping) request id=0x0009, seq=2/512, ttl=255 28 25.594339 172.16.16.88 -> 172.16.16.254 ICMP 114 Echo (ping) reply id=0x0009, seq=2/512, ttl=64 (request in 27) 29 25.596420 172.16.16.254 -> 172.16.16.88 ICMP 114 Echo (ping) request id=0x0009, seq=3/768, ttl=255 30 25.596590 172.16.16.88 -> 172.16.16.254 ICMP 114 Echo (ping) reply id=0x0009, seq=3/768, ttl=64 (request in 29) 31 25.598595 172.16.16.254 -> 172.16.16.88 ICMP 114 Echo (ping) request id=0x0009, seq=4/1024, ttl=255 32 25.598669 172.16.16.88 -> 172.16.16.254 ICMP 114 Echo (ping) reply id=0x0009, seq=4/1024, ttl=64 (request in 31) 33 30.591415 OUIMaker_XX:10:ca -> Cisco_XX:fc:c0 ARP 60 Who has 172.16.16.254? Tell 172.16.16.88 34 30.592998 Cisco_XX:fc:c0 -> OUIMaker_XX:10:ca ARP 60 172.16.16.254 is at XX:XX:XX:XX:fc:c0 ■Cisco側のリンクダウン/アップ時にはMDNSパケットは流れない。 [Linux1]側のeth1リンクダウン/アップ時にMDNSパケットが流れる。 方向も[172.16.16.88.5353 > 224.0.0.251.5353]なので、 Cisco側やモニタポートに接続した[Linux2]のトリガーでは無い。 $ echo "[Linux1]";sudo ifconfig eth1 down;sudo ifconfig eth1 up [Linux1] ■[Linux2]のモニタポート側にもIPを設定するとしたら、 例えば以下のようにIPをずらしておく。 ([/etc/network/interfaces]スクリプトからifup/ifdownで操作する場合は、 [ifconfig]を使わないので注意。) $ echo "[Linux2]";sudo ifconfig eth1 172.16.16.89/24 [Linux2]
