Contrail provides traffic mirroring so you can mirror specified traffic to a traffic analyzer where you can perform deep traffic inspection. Traffic mirroring enables you to designate certain traffic flows to be mirrored to a traffic analyzer, where you can view traffic flows in great detail.

Use Monitor > Debug > Packet Capture to configure packets to be captured and “mirrored” to a virtual machine configured as a traffic analyzer. The packet activity can then be inspected for monitoring and troubleshooting purposes. This section demonstrates how to set up packet capture to mirror traffic packets to an analyzer.

• Traffic Analyzer Images
• Configuring Traffic Analyzers
• Setting Up Traffic Mirroring Using Monitor > Debug > Packet Capture
• Setting Up Traffic Mirroring Using Configure > Networking > Services

In Contrail Controller, you use a two-part configuration to mirror captured packet traffic to a traffic analyzer, where the traffic details can be inspected. The configuration has the following steps:

1. Configure analyzer(s) on the host.
2. Set up rules for packet capture.

Additionally, there are two ways to configure the packet capture for the analyzers from within the Contrail interface:

• Configure from Monitor > Debug > Packet Capture
• Configure from Configure > Networking > Services

1. Select Monitor > Debug > Packet Capture. The Packet Capture screen appears; see Figure 1.

   Figure 1: Packet Capture

   
2. Click Create to add an analyzer; see Figure 2.

   Figure 2: Create Analyzer

   
3. In the Analyzer Name field, enter a name for the analyzer and in the Virtual Network field, select Automatic or select a specific virtual network from the drop-down list of available networks; click Save when finished.
4. To create rules for the analyzer, in the lower portion of the Create Analyzer screen, click the + button to add a rule.

   The Analyzer Rules fields appear; see Figure 3.

   Figure 3: Analyzer Rules

   
5. Select the rules to apply to determine which packets should be “mirrored”—sent to the analyzer for monitoring.

   See Table 1 for guidelines for completing the rule fields.

   Table 1: Analyzer Rule Fields

   Field	Description
   IP Protocol	Select from a list to define from which protocol packets are to be captured: ANY TCP UDP ICMP
   Source Network	Select from a list the source network from which packets are to be captured: any local domain:network 1 domain:network 2 domain:network .....
   Source Ports	If you want to capture only those packets that originate from a specific port number, enter the port number.
   Direction	Select the direction of flow for the packets to be captured: Bidirectional Unidirectional
   Destination Network	Select from a list the destination network for the packets to be captured: any local domain:network 1 domain:network 2 domain:network .....
   Destination Ports	If you want to capture only those packets that are destined to a specific port number, enter the port number.
   Cancel, Save	When finished, click Save to commit your selections, or click Cancel to clear the entries and start over.

6. To associate virtual networks with the analyzer, click the Associate Networks field in the center portion of the screen. Select from a drop-down list of available networks the networks to associate with this analyzer; see Figure 4.

   Figure 4: Create Analyzer Associate Networks

   

   Note: If there is already a network policy attached to the virtual network selected, any conflicting rules configured for the analyzer will not take effect.

7. View the analyzer activity from Monitor > Debug > Packet Capture. For the selected analyzer, click in the Action column and select View Analyzer; see Figure 5.

   Figure 5: Launch Analyzer VM

   
8. The Wireshark Packet Capture Display appears; see Figure 6.

   Figure 6: Packet Capture Display

   

Setting Up Traffic Mirroring Using Configure > Networking > Services

You can set up packet capture for mirroring to an analyzer within a service chain utilizing more than one interface by starting with a service template. The following procedure provides the steps needed.

1. Access Configure > Services > Service Templates.

   The Service Templates screen appears; see Figure 7.

   Figure 7: Service Templates

   
2. To create a new service template, click the + icon.

   The Create window appears. Select the Service Template tab; see Figure 8.

   Figure 8: Create Service Template

   
3. Complete the fields by using the guidelines in Table 2.

   Table 2: Create Service Template Fields

   Field	Description
   Name	Enter a descriptive text name for this service template.
   Version	Select v2 from the drop-down list to indicate that this service template is based on templates version 2, valid for Contrail 3.0 and later.
   Virtualization Type	Select Virtual Machine from the drop-down list to indicate the virtualization type for mirroring for this template.
   Service Mode	Select Transparent from the drop-down list to indicate that this service template is for transparent mirroring.
   Service Type	Select Analyzer from the drop-down list to indicate that this service template is for a traffic analyzer.
   Interface(s)	From the drop-down list, click the check boxes to indicate which interface types are used for this analyzer service template: Left Right Management
   Save	When finished, click OK to commit the changes
   Cancel	Click Cancel to clear the fields and start over.

4. Create a service instance by clicking the Service Instances link and clicking the + icon.

   The Create window appears; make sure the Service Instance tab is selected. See Figure 9.

   Figure 9: Create Service Instances

   
5. Complete the fields by using the guidelines in Table 3.

   Table 3: Create Service Instances Fields

   Field	Description
   Name	Enter a text name for this service instance.
   Service Template	Select from a drop-down list of available service templates the template to use for this service instance, analyzer-service-template in this example.
   Interface Type	Each interface configured in the service template for this instance appears in a list.
   Virtual Network	Select from a drop-down list of available virtual networks the network for each interface that is configured for the instance.
   Save	Click Save to commit your changes.
   Cancel	Click Cancel to clear your changes and start over.

6. To create a network policy rule for this service instance, click Configure > Networking > Policies. The Policies window appears. Click the + icon to get to the Create window; see Figure 10.

   Figure 10: Create Policy

   
8. Enter a name for the policy, then click the + icon in the lower portion of the screen to configure rules for the policy, see Figure 11.

   Figure 11: Create Policy Rules

   
9. To add policy rules, complete the fields, using the guidelines in Table 4.

   Note: When there is a network policy attached to the virtual network, any conflicting rules configured for the analyzer will not take effect.

   Table 4: Add Rule Fields

   Field	Description
   Action	Select PASS or DENY as the rule action.
   Protocol	Select the protocol for the policy rule, or select ANY.
   Source	Select from multiple drop-down lists the source for this rule, including options under CIDR, Network, Policy, or Security Group.
   Ports	Select from a drop-down list the source ports for the rule.
   Direction	Select the direction of flow for the packets to be captured: <> (bidirectional) > (unidirectional)
   Destination	Select from multiple drop-down lists the destination for this rule, including options under CIDR, Network, Policy, or Security Group.
   Ports	Select from a list the destination ports for the packets to be captured.
   check boxes	Check any box that applies to this rule: Log, Services, Mirror, QoS.
   Save	Click Save to commit your changes.
   Cancel	Click Cancel to clear your changes and start over.

10. When finished, click Save.
11. To verify packet capture, at Configure > Services > Service Instances, select the analyzer service instance and click View Console.

    The packet capture displays; see Figure 12. The analyzer service VM launches the Contrail-enhanced Wireshark as it starts and captures the mirrored packets destined to this service.

    Figure 12: Service Instances View Console