portainer import的镜像不能使用镜像端口配置

转载

lgmyxbjfu 2024-03-15 10:07:00

文章标签 网络 Cisco TCP ide 文章分类 云原生云计算

端口镜像

概念：把交换同个或多个端口（vlan）的镜像到一个或多个端口的方法。

需求：通常为了部署IDS产品需要监听网络流量，但是在目前广泛采用的交换网络中监听所有流量有相当大的困难，因此通过配置交换机来把一个或多个端口（vlan）的数据转发到某一个端口来实现对网络的监听。

端口镜像通常有以下几种别名：

Port Mirroring 通常指允许把一个端口的流量复制到另外一个端口，同时这个端口不能再传输数据

Monitoring port 监控端口

Spanning Port 通常指允许把所有端口的流量复制到另外一个端口，同时这个端口不能再传输数据

SPAN port 在cisco产品中，SPAN通常指switch port analyzer 某些交换机的span端口不支持传输数据

支持端口镜像的交换机

大多数中档以上的交换机都支持端口镜像功能，但支持的程序不同

端口镜像配置方法：

http://www.securitywizardry.com/switch.htm

port Mirroring generally indicates the ability to copy the traffic from a single port to a mirror port but disallows any type of bidirectional traffic on the port.

Spanning Port usually indicates the ability to copy traffic from all the ports to a single port but also typically disallows bidirectional traffic on the port.

In the case of Cisco, SPAN stands for Switch Port ANalyzer. Some switches do not allow SPAN ports to transmit packets, this is an issue if you wish to use IDS TCP countermeasures such as resets.

Extreme Switches Newer

Submitted By Kevin Farnes

Information Updated: 16 Aug 2004

{enable | disable} mirroring on port Port No

configure mirroring { add | delete } { vlan VLAN | port Port No }

The first line basically turns on or off the mirroring and what port the mirrored output should be sent to. The second line specifies what is

to be mirrored. The second line can be repeated any number of times. There are some limitations on capability however, such as if

you are mirroring a port then it must be on the same blade as the port being mirrored to.

Extreme Switches Older eg 48 ExtremeWare Version 4.1

Submitted By Joel Snyder

Information Updated: 16 Aug 2004

In the older Summit Extremes (like the 48, not the 48i), you are blocked at v4 of their software

enable mirror to port <port-no> (both enables mirroring, and says where to send it. Notice that you cannot provide a list of ports, unfortunately)

disable mirror (disables mirroring)

config mirror add port <portno> (adds port <portno>, all VLANs that this port participates in)

config mirror add port <portno> vlan <vlan name or #> (adds port <portno>, but only VLAN <vlan> traffic will be mirrored)

config mirror add vlan <vlan name or #> (adds all ports that have this VLAN)

You can add more than one port by repeating the above lines.

config mirror del port <portno>

config mirror del vlan <vlan> (does the obvious thing)

show mirror (shows status of mirroring, including whether the port is up or not (!))

One thing to be careful of in the Extreme is that with mirroring (at least in this version of the O/S), you get both IN and OUT mirroring,

which means that if you pick a VLAN as the mirror object, you may see the same frame a couple of times if it goes in one port on the VLAN and out a different one.

Cisco Catalyst SPAN Support

Submitted By Mark McDonagh

Information Updated: 16 Aug 2004

Switch SPAN Sessions TCP Countermeasures

2900/3500XL No Limit No

2950 1 Yes

3550 2 Yes

3750 2 Yes

4000 w CatOS 5 Yes

4500 w Native IOS 6 (both considered 2) No

6000 w CatOS 2 Rx or Both, 4 Tx Yes

6000 w Native IOS 2 No

Cisco Catalyst 2900/3500XL

Submitted By Mark McDonagh

Information Updated: 17 Aug 2004

c3550(config)#monitor session 1 source ?

interface SPAN source interface

remote SPAN source Remote

vlan SPAN source VLAN

c3550(config)#monitor session 1 source interface fa0/1 - 3 rx

c3550(config)#monitor session 1 destination interface fa0/24

Only an Rx SPAN session can have multiple source ports. Note the spaces in syntax when specifying multiple interfaces. Can be “–” or “,”

With Source VLAN's

c3550(config)#monitor session 1 source vlan 1 - 10 rx

c3550(config)#monitor session 1 destination interface fa0/24

TCP Resets

c3550(config)#monitor session 1 source vlan 1 - 10 rx

c3550(config)#monitor session 1 destination interface fa0/24 ingress vlan 1

The Catalyst 2950/3550 will allow you to configure a single VLAN to receive untagged TCP Reset packets. TCP Reset support is configured through the “ingress vlan” keywords. Only one VLAN is permitted. In this example, non-802.1q-tagged TCP Resets to servers or attackers existing on or through VLAN 1 would be allowed, but not if the attack or target was on VLAN 2-10. If the RST is a response to an attack detected by IDS 4.x where the 802.1q tag has been maintained, the RST will be sent on the appropriate VLAN.

If you are monitoring a VLAN trunk port, you may wish to filter one or more of the VLANs on that trunk. This example only monitors VLANs 5 and 100-200 on the trunk.

c3550(config)#monitor session 1 source interface gigabit0/1

c3550(config)#monitor session 1 filter vlan 5 , 100 - 200

c3550(config)#monitor session 1 destination interface fa0/24

If the monitor session destination port is a trunk, you should also use keyword ‘encapsulation dot1q’. If you do not, packets will be sent on the interface in native format.

Cisco Catalyst 2950 3550 3750

Submitted By Mark McDonagh

Information Updated: 17 Aug 2004

int fa0/24

port monitor fa0/1

port monitor fa0/2

port monitor fa0/3

show port monitor

Monitor Port Port Being Monitored

--------------------- ---------------------

FastEthernet0/24 FastEthernet0/1

FastEthernet0/24 FastEthernet0/2

FastEthernet0/24 FastEthernet0/3

Monitored ports must be on same VLAN

Cannot modify monitored ports

“port monitor vlan” is only valid for VLAN 1, and will only monitor management traffic destined to the IP address configured as VLAN 1 on the switch “port monitor”, by itself, will configure the port to monitor all ports on the switch that belong to the vlan that port is assigned to.

Cisco Catalyst 4000 6000 with CatOS Switches

Submitted By Mark McDonagh

Information Updated: 16 Aug 2004

On Cat6k:

set span {src_mod/src_ports| src_vlans | sc0} {dest_mod/dest_port} [rx | tx | both] [inpkts {enable | disable}] [learning {enable | disable}] [multicast {enable | disable}] [filter vlans...] [create]

On Cat4k:

set span {src_mod/src_ports | src_vlan} dest_mod/dest_port [rx | tx | both] [filter vlan] [inpkts {enable | disable}] [learning {enable | disable}] [create]

Use the ‘create’ keyword with different destination ports to create multiple SPAN sessions.

If the ‘create’ keyword is not used, and a span session exists with the same destination port, the existing session will be replaced. If the destination port is different, then a new session will be created.

With source 2/1 and destination 3/5

c6500 (enable) set span 2/1 3/5

Cisco Catalyst 4000 6000 with IOS Switches

Submitted By Mark McDonagh

Information Updated: 16 Aug 2004

Syntax for Cat4k:

Cat4k(config)# [no] monitor session {session_number} {source {interface type/num} | {vlan vlan_ID}} [, | - | rx | tx | both]

Cat4k(config)# [no] monitor session {session_number} {destination {interface type/num} }

Syntax for Cat6k:

Cat6k(config)# monitor session session_number source {{single_interface | interface_list | interface_range | mixed_interface_list | single_vlan | vlan_list | vlan_range | mixed_vlan_list} [rx | tx | both]} | {remote vlan rspan_vlan_ID}}

Cat6k(config)# monitor session session_number destination {single_interface | interface_list | interface_range | mixed_interface_list} | {remote vlan rspan_vlan_ID}}

Cisco Catalyst 2950 Switches

Submitted By Kevin Farnes

Information Updated: 16 Aug 2004

( From Configuration Mode )

monitor session 1 source interface Interface

monitor session 1 destination interface Interface

The first line determines which ports are being monitored in the session and can be repeated. The second line determines where the

monitor output is to be sent. On the 2950 only ports can be monitored. With Cisco the monitoring capability and commands can vary significantly with different models of switch.

Cisco 3500XL Switches

Submitted By Chris McCulloh

Information Updated: 16 Aug 2004

Connect via a command line, then enter enable mode (type 'en').. then execute the following commands, assuming the sniffer is plugged into port 14 on the switch, and all other ports in a 24 port switch are desired except 23:

configure terminal

interface f14

port monitor f1-13, f15-22,f24

end

The box should then see all traffic.

Cisco Catalyst 5000 Switches

Submitted By Dave Rodrigue

Information Updated: 16 Aug 2004

set span 2-3 5/7 create

where 2-3 are the VLANs I'm monitoring.

Switch ports can be specified as well

set span 2/3 5/7 create to monitor port 2/3

~From Cisco's docs, in case that makes it clearer:

set span {src_mod/src_ports | src_vlan | sc0} dest_mod/dest_port [rx | tx | both] [inpkts {enable | disable}] [learning {enable | disable}] [multicast {enable | disable}] [create]

Foundry Switches

Submitted By Kevin Farnes

Information Updated: 16 Aug 2004

( From Configuration Mode )

interface Interface

port monitor interface { rx | tx | both}

The first line takes you into the interface that the mirror output should be presented on. The second line defines those interfaces you wish to have mirrored and whether just the input, output or both are copied.

Juniper M or T Series

Submitted By Donald Smith

Information Updated: 20 Aug 2004

Port Mirroring

Define the destination where copies of sampled packets will be sent:

[edit]

user@router# show forwarding-options

port-mirroring { input {family inet; rate <sample-rate>; run-length

<run-length>;} output {interface <interface-name> {next-hop<address>;}

no-filter-check;} }

2. Define a sampling filter to identify "interesting" traffic:

[edit]

user@router# show firewall filter mirror-sample

from {...} then {sample; accept;}

3. Apply the filter to the incoming interface

[edit]

user@router# show interface <interface-name> unit 0 family inet

filter {input mirror-sample;}

Notes:

1. Packets that pass the input filter are sampled based on the <sample-rate> and <run-length>. In each batch of <sample-rate> packets, the first <run-length> packets are mirrored.

2. The mirror interface should not participate in any routing. The sampled packets are not in any way encapsulated, so the raw packets are sent out the interface. Hopefully, the device on the far end is a traffic analyzer and not another router!

3. The <address> needs to be specified when the mirror interface is a multi-access media, and is used to fil in the MAC address.

4. Works only for IPv4 packets, and only for transit traffic.

5. You can only set up one mirror interface per router; all "sampled" traffic is mirrored.

特点：●Cisco 2900 和 Cisco 3500XL 系列交换机

Cisco 2950、Cisco 3550 和 Cisco 3750 系列交换机

Cisco catylist 2550 Cisco catylist 3550 支持2组monitor session en password config term

Switch(config)#monitor session 1 destination interface fast0/4（1为session id，id范围为1－2）

Switch(config)#monitor session 1 source interface fast0/1 , fast0/2 , fast0/3 (空格，逗号，空格)

Switch(config)#exit

Switch#copy running-conf startup-conf

Switch#show port-monitor

Cisco 5000 系列交换机

使用 CatOS 的 Cisco 4000 和 Cisco 6000 系列交换机

使用 IOS 的 Cisco 4000 和 Cisco 6000 系列交换机

Extreme 交换机

特点：

●只能创建多对一或者一对一的镜像端口

●可以监听 VLAN 的流量

●Extreme 会镜像 IN 和 OUT 的流量。这就意味着在镜像 VLAN 的时候，会看到一个报文至少两次— —从 VLAN 的某个端口出来，并且进入 VLAN 的另一个端口。

版本高于4.1的 Extreme 交换机端口镜像配置方法

{enable | disable} mirroring on port

开启/关闭端口镜像功能，并且指定镜像流量从何端口流出，port-no 只能是一个端口

configure mirroring { add | delete } { vlan | port }

指定镜像哪个或哪些 VLAN 或端口的流量 { vlan | port } 部分可以重复多次

版本低于 4.1 的 Extreme 交换机端口镜像配置方法

enable mirror to port port-no

开启端口镜像功能，并且指定镜像流量从何端口流出，port-no 只能是一个端口

disable mirror

关闭端口镜像功能

config mirror add port 镜像端口 port-no 的流量，如果这个端口包含多个 VLAN 这些流量都会被镜像到目的端口

config mirror add port vlan

镜像端口 port-no 中指定 VLAN 的流量

config mirror add vlan

镜像端口中指定 VLAN 的所有端口的流量

config mirror del port

取消对 port-no 的端口镜像

config mirror del vlan

取消对指定 VLAN 的端口镜像

show mirror

显示端口镜像情况

Foundry 交换机特点：

●可以创建多对多的端口镜像

Foundry 交换机端口镜像配置方法

在配置模式中（Configuration Mode）：

interface

port monitor { { rx | tx | both}}

确定镜像流量从哪个端口流出，修改此端口配置

指定要镜像哪些端口的哪些流量（rx 指接收的流量，tx 指发送的流量，both 指双向流量），{ { rx | tx | both}} 部分可以重复

Juniper 交换机

特点：

●每交换机只能有一个监听端口

●只能镜像 IPv4 的流量

●只能镜像发送（transit only）的流量，不能镜像接收的流量

Juniper M 系列和 T 系列端口镜像配置方法

[url=mailto:usen@router]usen@router[/url]# show forwarding-options port- mirroring { input {family inet; rate ; run- length ;} output interface {next-hop

;} no-filter-check;} }

选择将抽样的流量发送到哪个目的端口

[url=mailto:user@router]user@router[/url]# show firewall filter mirror-sample from {...} then {sample; accept;}

定义抽样过滤器，选择感兴趣的流量

[url=mailto:user@router]user@router[/url]# show interface unit 0 family inet filter {input mirror-sample;}

选择将抽样的过滤器应用到某个端口

端口镜像的风险

加重交换机负载，造成设备不稳定

在某些情况下会丢包，不能保证 100% 镜像流量。例如，由于多个源端口镜像到一个目的端口，目的端口无法处理造成丢包 [/i

转载于:https://blog.51cto.com/cysky/741492

本文章为转载内容，我们尊重原作者对文章享有的著作权。如有内容错误或侵权问题，欢迎原作者联系我们进行内容更正或删除文章。