M9010防火墙怎么抓包

# 配置IPv4高级ACL 3001，匹配抓包对应的报文，如匹配源地址为10.1.1.0/24网段的用户。

<Device> system-view

[Device] acl advanced 3001

[Device-acl-ipv4-adv-3001] rule 0 permit ip source 10.1.1.0 0.0.0.255 destination 20.1.1.0 0.0.0.255

 [Device-acl-ipv4-adv-3001] quit

# 创建流分类abc，并配置报文匹配规则为ACL 3001。

[Device] traffic classifier abc

[Device-classifier-abc] if-match acl 3001

[Device-classifier-abc] quit

# 创建流行为abc，并配置流镜像到Context所进驻安全引擎组的主安全引擎上（本举例假设此主安全引擎的Blade接口为Blade 4/0/1。

[Device] traffic behavior abc

[Device-behavior-abc] mirror-to interface blade 4/0/1

[Device-behavior-abc] quit

# 创建QoS策略abc，在策略中为流分类abc指定采用流行为abc。

[Device] qos policy abc

[Device-qospolicy-abc] classifier abc behavior abc

[Device-qospolicy-abc] quit

# 将QoS策略abc应用到抓包流量对应的接口，如接口GigabitEthernet1/0/1的inbound和outbound方向上，且必须开启enhancement功能。

[Device] interface gigabitethernet 1/0/1

[Device-GigabitEthernet1/0/1] qos apply policy abc inbound enhancement

[Device-GigabitEthernet1/0/1] qos apply policy abc outbound enhancement

[Device-GigabitEthernet1/0/1] quit