Device model: NE40E-X8A
Software version: V800R009C10SPC200
The difference between the traffic rate of the mirroring interface and the traffic rate of observing interface is several Gbit/s.
Mirroring interface: dis interface 100g 1/0/0
Last 300 seconds input rate: 9383061957 bits/sec, 1614471 packets/sec
Observing interface: dis
interface 100GE 8/0/1
Last 300 seconds output rate: 5103017237 bits/sec, 696939 packets/sec
Check the configuration of mirroring interfaces. It is found that the CAR configuration exists.
To prevent mirroring packets from affecting traffic forwarding, the device implements CAR for the mirroring packets by default.
The default value of CIR is 2.5 Gbit/s. Both the incoming and outgoing traffic of the mirroring interface are mirrored. There is a total of about 5 Gbit/s traffic on the observing interface.
Conclusion: The default of mirroring packets causes such inconsistency between the mirroring interface and observing interface.
Run the port-mirroring car command to change the CAR value of mirroring packets. For details, see the product document.
Note that if a CAR value exceeding the specified threshold may interrupt service forwarding.
2.Use NetStream to got packet statistics.
Full packet mirroring is not required for mere packet analysis. Instead, you can deploy the NetStream service.
The number of sampled packets is small, which slightly affects the forwarding of service packets. In this way, packets can be analyzed without affecting traffic forwarding.