Port mirroring¶
Open vSwitch allows you to direct a copy of the traffic flow from one or more interfaces to another. It can also organize traffic redirection from the entire VLAN to a specific port or vice versa. Only incoming traffic, only outgoing traffic, or both types of traffic can be mirrored. Using this feature will allow you to monitor network traffic transmitted between instances in order to detect (prevent) computer attacks.
Example:¶
Mirroring traffic from the vnet2 interface, which belongs to the same instance, to the mirror0 port specially created for listening with the type internal
:
sudo ovs-vsctl -- set Bridge ovs-sw0 mirrors=@m -- \
--id=@mirror0 get Port mirror0 -- --id=@vnet2 get Port vnet2 -- \
--id=@m create Mirror name=mymirror select-dst-port=@vnet2 \
select-src-port=@vnet2 output-port=@mirror0
where the –id=@<variable_name>
construct determines the use of the variable;
the command set Bridge ovs-sw0 mirrors=@m
creates a mirror, the name and parameters of which are obtained from the variable @m
;
the command –id=@mirror0 get Port mirror0 ––id=@vnet2 get Port vnet2
determines the values of the variables @mirror0
, @vnet2
- the identifiers of the corresponding ports are written;
the command –id=@m create Mirror name=mymirror select-dst-port=@vnet2 select-src-port=@vnet2 output-port=@mirror0
determines the value of the variable @m
- the name and mirror parameters;
select-dst-port
is incoming traffic mirroring;
select-src-port
is outbound traffic mirroring;
output-port
is place of traffic redirection.
With the tcpdump
console utility running on the node, you can listen to all traffic coming to, for example, the mirror0
port. To do this, you need to run the command:
tcpdump -i mirror0
It is also possible to organize relaying of all packets, for example, those that came to the port eth0
or eth1
to the port eth2
:
sudo ovs-vsctl -- set Bridge ovs-sw0 mirrors=@m \
-- --id=@eth0 get Port eth0 -- --id=@eth1 get Port eth1 \
-- --id=@eth2 get Port eth2 \
-- --id=@m create Mirror name=mymirror -- select-dst-port=@eth0,@eth1 \
select-src-port=@eth0,@eth1 output-port=@eth2
where the –id=@<variable_name>
construct determines the use of the variable;
the set Bridge ovs-sw0 mirrors=@m
command creates a mirror whose name and parameters are obtained from the @m
variable;
the command ––id=@eth0 get Port eth0 – –id=@eth1 get Port eth1 – –id=@eth2 get Port eth2
determines the values of the variables @eth0
, @eth1
and ` @eth2`;
the command –id=@m create Mirror name=mymirror select-dst-port=@eth0, @eth1 select-src-port=@eth0,@eth1 output-port=@eth2
defines the value of the variable @m
is the name and parameters of the mirror are written;
select-dst-port
is incoming traffic mirroring;
select-src-port
is outbound traffic mirroring;
output-port
is place of traffic redirection.
To cancel mirroring, run the command:
sudo ovs-vsctl remove Bridge ovs-sw0 mirrors mymirror