Field	Description
Mirroring group	Number of the mirroring group.
Type	Type of the mirroring group: · Local. · Remote source. · Remote destination.
Status	Status of the mirroring group: · Active—The mirroring group has taken effect. · Incomplete—The mirroring group configuration is not complete and does not take effect.
Mirroring port	Source port.
Mirroring CPU	Source CPU.
Monitor port	Destination port and the processing for mirrored packets. truncation means truncating mirrored packets is enabled on the port.
Encapsulation	Encapsulation parameters of the mirrored packets.
Destination IP address	Destination IP address in the outer header of the GRE-encapsulated mirrored packets.
Source IP address	Source IP address in the outer header of the GRE-encapsulated mirrored packets.
DSCP	DSCP value in the outer header of the GRE-encapsulated mirrored packets.
VLAN	VLAN in the outer header of the GRE-encapsulated mirrored packets.
VRF Instance	VPN instance whose routing table is used to direct forwarding of the mirrored packets.
Destination MAC address	This field is not supported in the current software version. Destination MAC address in the outer header of the GRE-encapsulated mirrored packets.
Reflector port	Reflector port for the outgoing mirrored packets of mirroring source ports.
Probe VLAN	Probe VLAN for a reflector port.

‌

mirroring-group

Use mirroring-group to create a mirroring group.

Use undo mirroring-group to delete mirroring groups.

Syntax

mirroring-group group-id { local | remote-destination | remote-source }

undo mirroring-group { group-id | all | local | remote-destination | remote-source }

Default

No mirroring groups exist.

Views

System view

Predefined user roles

network-admin

Parameters

group-id: Specifies a mirroring group ID. The value range for this argument is 1 to 7.

local: Specifies local mirroring groups.

remote-destination: Specifies remote destination groups.

remote-source: Specifies remote source groups.

all: Specifies all mirroring groups.

Examples

# Create local mirroring group 1.

<Sysname> system-view

[Sysname] mirroring-group 1 local

mirroring-group mirroring-port (interface view)

Use mirroring-group mirroring-port to configure a port as a source port for a mirroring group.

Use undo mirroring-group mirroring-port to restore the default.

Syntax

mirroring-group group-id mirroring-port { both | inbound | outbound }

undo mirroring-group group-id mirroring-port

Default

A port does not act as a source port for any mirroring groups.

Views

Interface view

Predefined user roles

network-admin

Parameters

group-id: Specifies a mirroring group by its ID. The value range for this argument is 1 to 7.

both: Mirrors both received and sent packets.

inbound: Mirrors only received packets.

outbound: Mirrors only sent packets.

Usage guidelines

You can configure source ports only for local mirroring groups and remote source groups.

Do not assign a source port of a mirroring group to the remote probe VLAN of the mirroring group.

A source port cannot be used as a reflector port, monitor port, or egress port.

Examples

# Create local mirroring group 1 to monitor the bidirectional traffic of the port Twenty-FiveGigE 1/0/1.

<Sysname> system-view

[Sysname] mirroring-group 1 local

[Sysname] interface twenty-fivegige 1/0/1

[Sysname-Twenty-FiveGigE1/0/1] mirroring-group 1 mirroring-port both

# Create remote source group 2 to monitor the bidirectional traffic of the port Twenty-FiveGigE 1/0/2.

<Sysname> system-view

[Sysname] mirroring-group 2 remote-source

[Sysname] interface twenty-fivegige 1/0/2

[Sysname-Twenty-FiveGigE1/0/2] mirroring-group 2 mirroring-port both

Related commands

mirroring-group

mirroring-group mirroring-port (system view)

Use mirroring-group mirroring-port to configure source ports for a mirroring group.

Use undo mirroring-group mirroring-port to remove source ports from a mirroring group.

Syntax

mirroring-group group-id mirroring-port interface-list { both | inbound | outbound }

undo mirroring-group group-id mirroring-port interface-list

Default

No source port is configured for a mirroring group.

Views

System view

Predefined user roles

network-admin

Parameters

group-id: Specifies a mirroring group by its ID. The value range for this argument is 1 to 7.

interface-list: Specifies a space-separated list of up to eight interface items. Each item specifies an interface by its type and number or specifies a range of interfaces in the form of interface-type interface-number1 to interface-type interface-number2. When you specify a range of interfaces, the interfaces must be of the same type and on the same slot. The start interface number must be identical to or lower than the end interface number.

both: Mirrors both received and sent packets.

inbound: Mirrors only received packets.

outbound: Mirrors only sent packets.

Usage guidelines

You can configure source ports only for local mirroring groups and remote source groups.

Do not assign a source port of a mirroring group to the remote probe VLAN of the mirroring group.

A source port cannot be used as a reflector port, monitor port, or egress port.

Examples

# Create local mirroring group 1 to monitor the bidirectional traffic of Twenty-FiveGigE 1/0/1.

<Sysname> system-view

[Sysname] mirroring-group 1 local

[Sysname] mirroring-group 1 mirroring-port twenty-fivegige 1/0/1 both

# Create remote source group 2 to monitor the bidirectional traffic of Twenty-FiveGigE 1/0/2.

<Sysname> system-view

[Sysname] mirroring-group 2 remote-source

[Sysname] mirroring-group 2 mirroring-port twenty-fivegige 1/0/2 both

Related commands

mirroring-group

mirroring-group monitor-egress

Use mirroring-group monitor-egress to configure the egress port for a remote source group.

Use undo mirroring-group monitor-egress to restore the default.

Syntax

In system view:

mirroring-group group-id monitor-egress interface-type interface-number

undo mirroring-group group-id monitor-egress interface-type interface-number

In interface view:

mirroring-group group-id monitor-egress

undo mirroring-group group-id monitor-egress

Default

No egress port is configured for a remote source group.

Views

System view

Interface view

Predefined user roles

network-admin

Parameters

group-id: Specifies a mirroring group by its ID. The value range for this argument is 1 to 7.

interface-type interface-number: Specifies a port by its type and number.

Usage guidelines

You can configure egress ports only for remote source groups.

For port mirroring to work correctly, disable the following features on the egress port of a mirroring group:

· Spanning tree.

· Static ARP.

· MAC address learning.

The member port of an existing mirroring group cannot be configured as an egress port.

The member port of an aggregate interface cannot be configured as an egress port.

Examples

# Create remote source group 1. Configure Twenty-FiveGigE 1/0/1 as its egress port in system view.

<Sysname> system-view

[Sysname] mirroring-group 1 remote-source

[Sysname] mirroring-group 1 monitor-egress twenty-fivegige 1/0/1

# Create remote source group 2. Configure Twenty-FiveGigE 1/0/2 as its egress port in interface view.

<Sysname> system-view

[Sysname] mirroring-group 2 remote-source

[Sysname] interface twenty-fivegige 1/0/2

[Sysname-Twenty-FiveGigE1/0/2] mirroring-group 2 monitor-egress

Related commands

mirroring-group

mirroring-group monitor-port (interface view)

Use mirroring-group monitor-port to configure a port as the monitor port for a mirroring group.

Use undo mirroring-group monitor-port to restore the default.

Syntax

mirroring-group group-id monitor-port [ destination-ip destination-ip-address source-ip source-ip-address [ dscp dscp-value | vlan vlan-id | vrf-instance vrf-name | reflector-port interface-type interface-number probe-vlan probe-vlan-id ] * ] [ truncation ]

undo mirroring-group group-id monitor-port

Default

A port does not act as the monitor port for any mirroring groups.

Views

Interface view

Predefined user roles

network-admin

Parameters

group-id: Specifies a mirroring group by its ID. The value range for this argument is 1 to 7.

destination-ip destination-ip-address: Specifies the destination IP address for the mirrored packets.

source-ip source-ip-address: Specifies the source IP address for the mirrored packets.

dscp dscp-value: Specifies the DSCP value for the mirrored packets. The dscp-value argument can be a number in the range of 0 to 63 or a keyword in Table 2. The default DSCP value is 0.

Table 2 DSCP keywords and values

Keyword	DSCP value in binary	DSCP value in decimal
af11	001010	10
af12	001100	12
af13	001110	14
af21	010010	18
af22	010100	20
af23	010110	22
af31	011010	26
af32	011100	28
af33	011110	30
af41	100010	34
af42	100100	36
af43	100110	38
cs1	001000	8
cs2	010000	16
cs3	011000	24
cs4	100000	32
cs5	101000	40
cs6	110000	48
cs7	111000	56
default	000000	0
ef	101110	46

‌

vlan vlan-id: Specifies a VLAN by its VLAN ID in the range of 1 to 4094 for the mirrored packets.

vrf-instance vrf-instance-name: Specifies a VPN instance by its name, a case-sensitive string of 1 to 31 characters. The mirrored packets will be forwarded based on the routing table of the specified VPN instance.

truncation: Truncates the specified length of a mirrored packet from the specified start position and sends the truncated part to the monitor port.

reflector-port interface-type interface-number: Specifies a reflector port by its type and number for outgoing mirrored packets of mirroring source ports.

probe-vlan probe-vlan-id: Specifies a probe VLAN by its ID in the range of 1 to 4094.

Usage guidelines

You can configure monitor ports only for local mirroring groups and remote destination groups.

Only when you configure Layer 3 remote port mirroring through encapsulation parameters, you can configure the following encapsulation parameters for mirrored packets sent to the monitor port:

· Destination IP address, which is the IP address of the remote data monitoring device.

· Source IP address.

· Optional encapsulation parameters, including the DSCP value, VLAN, VPN instance, and destination MAC address.

The mirrored packet is first encapsulated in a GRE packet with a protocol number of 0x88BE. The GRE packet is then encapsulated in a delivery protocol by using the configured encapsulation parameters and routed to the final destination.

Do not enable the spanning tree feature on the monitor port of a mirroring group.

For a Layer 2 aggregate interface configured as the monitor port of a mirroring group, do not perform either of the following tasks:

· Configure its member ports as source ports of the mirroring group.

For a Layer 2 or Layer 3 aggregate interface configured as the monitor port of a mirroring group, do not configure its member ports as source ports of the mirroring group.

Use a monitor port only for port mirroring, so the data monitoring device receives and analyzes only the mirrored traffic.

The member port of an existing mirroring group cannot be configured as a monitor port.

The member port of an aggregate interface cannot be configured as a monitor port.

Mirrored packet truncation reduces the packet processing workload on the data monitoring device and prevents the payload in packets from be sent to the data monitoring device.

Only local mirroring groups support mirrored packet truncation.

To modify the mirrored packet truncation configuration, you must first execute the undo mirroring-group monitor-port command.

When a port is configured as a reflector port, all the other settings on the port will be cleared. You cannot configure other features on a reflector port.

When only incoming packets of mirroring source ports are mirrored, as a best practice, do not configure a reflector port for outgoing mirrored packets of mirroring source ports.

In a mirroring group, make sure the monitor port is different from the reflector port for outgoing mirrored packets of mirroring source ports.

You can configure a probe VLAN only for the reflector port of a local mirroring group. You cannot configure a probe VLAN for the reflector port of a remote source or destination group.

When a VLAN is configured as a probe VLAN for a reflector port, do not use the VLAN for any other purposes.

Only a static VLAN that already exists can be configured as a probe VLAN for a reflector port. A VLAN can be configured as the probe VLAN for the reflector port of only one mirroring group.

To delete a VLAN that is configured as a probe VLAN for a reflector port, first remove the probe VLAN configuration.

Examples

# Create local mirroring group 1 and configure Twenty-FiveGigE 1/0/1 as its monitor port.

<Sysname> system-view

[Sysname] mirroring-group 1 local

[Sysname] interface twenty-fivegige 1/0/1

[Sysname-Twenty-FiveGigE1/0/1] mirroring-group 1 monitor-port

# Create remote destination group 2 and configure Twenty-FiveGigE 1/0/2 as its monitor port.

<Sysname> system-view

[Sysname] mirroring-group 2 remote-destination

[Sysname] interface twenty-fivegige 1/0/2

[Sysname-Twenty-FiveGigE1/0/2] mirroring-group 2 monitor-port

# Create local mirroring group 3. Specify Twenty-FiveGigE 1/0/1 as its monitor port and configure the encapsulation parameters including the source and destination IP addresses, DSCP value, VLAN, and VPN instance for the mirrored packets.

<Sysname> system-view

[Sysname] mirroring-group 3 local

[Sysname] interface twenty-fivegige 1/0/1

[Sysname-Twenty-FiveGigE1/0/1] mirroring-group 3 monitor-port destination-ip 1.1.1.1 source-ip 3.3.3.3 dscp 1 vlan 1 vrf-instance 122

Related commands

mirroring-group

mirroring-group monitor-port (system view)

Use mirroring-group monitor-port to configure the monitor ports for a mirroring group.

Use undo mirroring-group monitor-port to remove the monitor ports from a mirroring group.

Syntax

mirroring-group group-id monitor-port interface-type interface-number [ destination-ip destination-ip-address source-ip source-ip-address [ dscp dscp-value | vlan vlan-id | vrf-instance vrf-name | reflector-port interface-type interface-number probe-vlan probe-vlan-id ] * ][ truncation ]

undo mirroring-group group-id monitor-port interface-type interface-number

Default

No monitor port is configured for a mirroring group.

Views

System view

Predefined user roles

network-admin

Parameters

group-id: Specifies a mirroring group by its ID. The value range for this argument is 1 to 7.

interface-type interface-number: Specifies an interface by its type and number.

destination-ip destination-ip-address: Specifies the destination IP address for the mirrored packets.

source-ip source-ip-address: Specifies the source IP address for the mirrored packets.

dscp dscp-value: Specifies the DSCP value for the mirrored packets. The dscp-value argument can be a number in the range of 0 to 63 or a keyword in Table 3. The default DSCP value is 0.

Table 3 DSCP keywords and values

Keyword	DSCP value in binary	DSCP value in decimal
af11	001010	10
af12	001100	12
af13	001110	14
af21	010010	18
af22	010100	20
af23	010110	22
af31	011010	26
af32	011100	28
af33	011110	30
af41	100010	34
af42	100100	36
af43	100110	38
cs1	001000	8
cs2	010000	16
cs3	011000	24
cs4	100000	32
cs5	101000	40
cs6	110000	48
cs7	111000	56
default	000000	0
ef	101110	46

‌

vlan vlan-id: Specifies a VLAN by its VLAN ID in the range of 1 to 4094 for the mirrored packets.

reflector-port interface-type interface-number: Specifies a reflector port by its type and number for outgoing mirrored packets of mirroring source ports.

probe-vlan probe-vlan-id: Specifies a probe VLAN by its ID in the range of 1 to 4094.

truncation: Truncates the specified length of a mirrored packet from the specified start position and sends the truncated part to the monitor port.

Usage guidelines

You can configure monitor ports only for local mirroring groups and remote destination groups.

Do not enable the spanning tree feature on the monitor port of a mirroring group.

Only when you configure Layer 3 remote port mirroring through encapsulation parameters, you can configure the following encapsulation parameters for mirrored packets sent to the monitor port:

· Destination IP address, which is the IP address of the remote data monitoring device.

· Source IP address.

· Optional encapsulation parameters, including the DSCP value, VLAN, VPN instance, and destination MAC address.

For a Layer 2 aggregate interface configured as the monitor port of a mirroring group, do not perform any of the following tasks:

· Configure its member ports as source ports of the mirroring group.

For a Layer 2 or Layer 3 aggregate interface configured as the monitor port of a mirroring group, do not configure its member ports as source ports of the mirroring group.

Use a monitor port only for port mirroring, so the data monitoring device receives only the mirrored traffic.