具体配置文档如下:
华三:https://www.h3c.com/cn/d_202009/1327093_30005_0.htm
华为:https://uniportal.huawei.com/uniportal/?redirect=https%253A%252F%252Fsupport.huawei.com%252Fhedex%252Fhdx.do%253Flib%253DEDOC110010122531180BDB%2526docid%253DEDOC1100101225%2526lang%253Dzh%2526v%253D02%2526tocLib%253DEDOC110010122531180BDB%2526tocV%253D02%2526id%253DZH-CN_CLIREF_0141119899%2526tocURL%253Dresources%25252fdc%25252fcapture%25252dpacket%25252ehtml%2526p%253Dt%2526fe%253D1%2526ui%253D3%2526keyword%253Dcapture
思科:https://www.cisco.com/c/en/us/support/docs/switches/nexus-7000-series-switches/116136-trouble-ethanalyzer-nexus7000-00.html
以上取自该偏文章总结:https://blog.csdn.net/qq_38265137/article/details/109865728?spm=1001.2014.3001.5501
对于现在某些交换机时已经支持acl匹配vxlan报文的内层源目ip、内层协议,通过这种方式就可以抓取到现网中某一条TCP流。
例如:在配置抓包条件匹配时,设置acl匹配vxlan报文,内层封装的源10.111.0.93,目的是10.122.1.1的vxlan报文,tcp封装。ACL过滤条件如下,其他配置和上述讲的类似:
rule 2 permit vxlan vxlan-id 31943 inner-protocol tcp inner-source 10.111.0.93 0 inner-destination 10.122.1.1
而对于某些交换机还不支持匹配vxlan报文的内层源目ip,所以一般也不就无法去抓取或统计某一条特定的流,只能匹配外层的vxlan id和外层的源目ip、端口号。如下:
rule 1 permit udp destination 10.111.0.44 0 destination-port eq 4789