1.IP sla
服务等级质量检测,思科私有,提供商与用户之间的协议
可以对带宽、延迟、丢包率、网络抖动进行检测
(1)针对icmp进行检测:
r1(config)#ip sla 1
r1(config-ip-sla)#icmp-echo 12.12.12.2 source-ip 12.12.12.1---用12.12.12.1这个源地址对12.12.12.2进行ping测试
r1(config-ip-sla-echo)#frequency 6 ---频率(默认6s)
r1(config-ip-sla-echo)#threshold 5 ---门限值(默认5s)
r1(config-ip-sla-echo)#timeout 5000---超时时间(默认5s)
r1(config)#ip sla schedule 1 start-time now life forever---调度
(2)针对Telnet进行检测:
客户端:
r1(config)#ip sla 2
r1(config-ip-sla)#tcp-connect 2.2.2.2 23 ---基于tcp23端口进行测试(Telnet测试)
r1(config-ip-sla-tcp)#exi
r1(config)#ip sla schedule 2 start-time now life forever
服务端:
r2(config)#ip sla responder---设置为响应端
查看命令:
r1#show ip sla statistics
2.TRACK
跟踪事件的结果,可以根据不同的结果与一些协议进行配合使用,执行不同的操作
(1)使用场景:
①静态路由
②第一跳冗余协议
1)跟踪IP sla:
r1(config)#ip sla 3
r1(config-ip-sla)#icmp-echo 2.2.2.2
r1(config-ip-sla-echo)#exi
r1(config)#ip sla schedule 3 start-time now life forever
r1(config)#track 3 ip sla 3 reachability
r1(config-track)#exi
r1(config)#ip route 0.0.0.0 0.0.0.0 12.12.12.2 track 3---如果track事件为up,则存在在该路由表,若为down则删除该条目
2)跟踪接口状态:
r1(config)#track 3 interface e0/0 line-protocol
r1(config)#ip route 0.0.0.0 0.0.0.0 12.12.12.2 track 3
3)跟踪路由信息:
r1(config)#track 3 ip route 12.12.12.0 255.255.255.0 reachability
r1(config)#ip route 0.0.0.0 0.0.0.0 12.12.12.2 track 3
查看命令:
r1#show track
3.NQA
类似于思科IP sla
[Huawei]nqa test-instance admin icmp
[Huawei-nqa-admin-icmp]test-type icmp ---测试类型
[Huawei-nqa-admin-icmp]destination-address ipv4 89.89.89.9
[Huawei-nqa-admin-icmp]start now
[Huawei]dis nqa results---查看事件结果
4.BFD
双向转发检测
(1)作用:提供快速检测,并且实现故障快速转移(毫秒级)
(2)会话模式:通过本地标识符和远端标识符来进行区分
会话ID:1-8191是静态,8912往后为动态
①静态BFD会话:需要手动配置本地标识符和远端标识符
②动态BFD会话:通过自动分配本地标识符和远端标识符
(3)会话状态:
①down
②init
③up
④admindown:管理员手动关闭
BFD状态的建立和拆除都是采用三次握手机制
(4)检测模式:
①异步模式:周期性的发送BFD检测报文进行检测
②查询模式:在验证连接的情况下,发送BFD检测报文进行检测
(5)BFD回声功能:对端设备不支持BFD的情况下,可以通过回声功能检测链路状态
(6)基本配置:
①与静态路由进行联动:
[R1]bfd
[R1]bfd12 bind peer 10.0.12.2 interface GigabitEthernet 0/0/1
[R1-bfd-session-12]discriminator local 10---指定本端标识符
[R1-bfd-session-12]discriminator remote 20---指定对端标识符
[R1-bfd-session-12]commit
[R2]bfd
[R2]bfd21 bind peer 10.0.12.1 interface GigabitEthernet 0/0/1
[R2-bfd-session-21]discriminator local 20
[R2-bfd-session-21]discriminator remote 10
[R2-bfd-session-21]commit
在R1与R2之间建立静态BFD会话:
[R1] ip route-static 4.4.4.4 32 10.0.12.2 track bfd-session 12
[R1] ip route-static 4.4.4.4 32 10.0.13.2 preference 100
②与ospf进行联动:
[R1]bfd
[R1]interface GigabitEthernet0/0/1
[R1-GigabitEthernet0/0/1]ipaddress 10.0.12.1 30
[R1]ospf1
[R1-ospf-1]area 0
[R1-ospf-1-area-0.0.0.0]network 10.0.12.0 0.0.0.3
[R1-ospf-1-area-0.0.0.0]quit
[R1-ospf-1]bfdall-interfaces enable
[R1-ospf-1]bfdall-interfaces min-tx-interval 100 min-rx-interval 100 detect-multiplier 3---设置最大发送间隔和最大接受间隔时间
查看命令:
[r1]dis bfd configuration all verbose ---查看BFD简要信息
5.端口镜像
SPAN:
(1)作用:可以监测到交换机的某些端口/vlan的流量(进出两个方向)
(2)局限性:只能针对本台交换机的流量进行监控
(3)基本配置
Switch(config)#monitor session 1 source interface e0/0---指定源接口
Switch(config)#monitor session 1 destination interface e0/2---指定目标接口
RSPAN:
远端监控,被监控的接口语流量抓取的接口不在同一台设备上时使用RSPAN
(1)作用:可以实现跨交换机来进行流量的监控
(2)基本配置:
sw1(config)#vlan 100
sw1(config-vlan)#remote-span ---定义为RSPAN
sw1(config-vlan)#exi
sw1(config)#monitor session 2 source interface e0/0
sw1(config)#monitor session 2 destination remote vlan 100---指定对端传输vlan
sw2(config)#vlan 100
sw2(config-vlan)#remote-span
sw2(config-vlan)#exi
sw2(config)#monitor session 2 source remote vlan 100
sw2(config)#monitor session 2 destination interface e0/1
华为:
[r1Ethernet2/0/3]observe-port interface Ethernet2/0/3
[r1-Ethernet2/0/1]interface Ethernet2/0/1
mirror to observe-port inbound
[r1]interface Ethernet2/0/2
[r1-Ethernet2/0/2]mirror to observe-port inbound
华三:
①SPAN
[SwitchC]mirroring-group 1 local
[SwitchC]mirroring-group 1 mirroring-port GigabitEthernet1/0/1 GigabitEthernet1/0/2 both---抓取g1/0/1和g1/0/2的进出方向的数据
[SwitchC]mirroring-group 1 monitor-port GigabitEthernet1/0/3
②RSPAN
[SwitchA]mirroring-group 1 remote-source
[SwitchA]vlan2
[SwitchA-vlan2]quit
[SwitchA]mirroring-group 1 remote-probe vlan2
[SwitchA]mirroring-group 1 mirroring-port GigabitEthernet1/0/1 GigabitEthernet1/0/2 inbound
[SwitchA]mirroring-group 1 monitor-egress GigabitEthernet1/0/3
[SwitchA]interface GigabitEthernet1/0/3
[SwitchA-GigabitEthernet1/0/3] port link-type trunk
[SwitchA-GigabitEthernet1/0/3] port trunk permit vlan2
[SwitchB]vlan2
[SwitchB-vlan2]undo mac-address mac-learning enable
[SwitchB-vlan2]quit
[SwitchB]interface GigabitEthernet1/0/1
[SwitchB-GigabitEthernet1/0/1]port link-type trunk
[SwitchB-GigabitEthernet1/0/1]port trunk permit vlan2
[SwitchB-GigabitEthernet1/0/1]quit
[SwitchB]interface GigabitEthernet1/0/2
[SwitchB-GigabitEthernet1/0/2]port link-type trunk
[SwitchB-GigabitEthernet1/0/2]port trunk permit vlan2
[SwitchC]interface GigabitEthernet1/0/1
[SwitchC-GigabitEthernet1/0/1] port link-type trunk
[SwitchC-GigabitEthernet1/0/1] port trunk permit vlan2
[SwitchC-GigabitEthernet1/0/1] quit
[SwitchC]mirroring-group 1 remote-destination
[SwitchC]vlan2
[SwitchC-vlan2]quit
[SwitchC]mirroring-group 1 remote-probe vlan2
[SwitchC]mirroring-group 1 monitor-port GigabitEthernet1/0/2
[SwitchC]interface GigabitEthernet1/0/2
[SwitchC-GigabitEthernet1/0/2]port access vlan2
查看命令:
sw1#show monitor session 2
6.流镜像:
(1)分类:
①流镜像到端口
②流镜像到CPU
(2)基本配置:
华三:
[H3C]acl number 2000
[H3C-acl-basic-2000]rule permit source 192.168.0.1 0
[H3C-acl-basic-2000]quit
[H3C]traffic classfier 1---定义类型
[H3C-classifier-1]if-match acl 2000---匹配ACL2000
[H3C-classifier-1]quit
[H3C]traffic behavior 1---定义行为
[H3C-behavior-1]mirror-to interface GigabitEthernet 1/0/2---执行将数据拷贝一份到g1/0/2
[H3C-behavior-1]quit
[H3C]qos policy 1---定义策略
[H3C-policy-1]classifier 1 behavior 1---将类型1和行为1结合
[H3C-policy-1]quit
[H3C]interface GigabitEthernet 1/0/1
[H3C-Ethernet1/0/1]qos apply policy 1 inbound--进入接口调用
华为:
observe-port interface Ethernet2/0/1
aclnumber 2000
rule 5 permit source 192.168.1.10 0
#
traffic classifier c1 operator or
if-match acl2000
#
traffic behavior b1
mirror to observe-port
#
traffic policy p1
classifier c1 behavior b1
#
interface Ethernet2/0/0
traffic-policy p1 inbound
7.Netflow
(1)作用:分析网络的数据包的信息
(2)组件:网络流量输出器、网络流量收集器、网络流量分析器、