Creates an inbound or outbound rule for traffic mirroring.

Debugging

OpenAPI Explorer automatically calculates the signature value. For your convenience, we recommend that you call this operation in OpenAPI Explorer. OpenAPI Explorer dynamically generates a sample code of the operation for different SDKs.

Request parameters

Parameter Type Required Example Description
Action String Yes CreateTrafficMirrorFilterRules

The operation that you want to perform. Set the value to CreateTrafficMirrorFilterRules.

RegionId String Yes cn-hongkong

The ID of the region to which the mirrored traffic belongs. You can call the DescribeRegions operation to query the most recent region list. For more information about regions that support traffic mirroring, see Overview of traffic mirroring.

TrafficMirrorFilterId String Yes tmf-j6cmls82xnc86vtpe****

The ID of the filter.

ClientToken String No 0c593ea1-3bea-11e9-b96b-88e9fe63****

The client token that is used to ensure the idempotence of the request. You can use the client to generate the value, but you must ensure that it is unique among different requests. ClientToken supports only ASCII characters. It can contain up to 64 ASCII characters.

DryRun Boolean No false

Specifies whether to precheck this request. Valid values:

  • true: only checks the API request. The inbound or outbound rule is not created. The system checks the required parameters, request format, and limits. If the request fails the precheck, the corresponding error code is returned. If the request passes the precheck, the DryRunOperation error code is returned.
  • false: sends the request. After the request passes the precheck, the inbound or outbound rule is created.
IngressRules.N.Priority Integer No 1

The priority of the inbound rule. A smaller value indicates a higher priority. The maximum value of N is 10, which indicates that you can configure at most 10 inbound rules for a filter.

IngressRules.N.Action String No accept

The collection policy of the inbound rule. Valid values:

  • accept: collects network traffic.
  • drop: does not collect network traffic.
IngressRules.N.Protocol String No TCP

The transport protocol used by inbound traffic that needs to be mirrored. Valid values:

  • ALL: all protocols
  • ICMP: Internet Control Message Protocol (ICMP)
  • TCP: TCP
  • UDP: UDP
IngressRules.N.DestinationCidrBlock String No 10.0.0.0/24

The destination CIDR block of the inbound traffic.

IngressRules.N.SourceCidrBlock String No 10.0.0.0/24

The source CIDR block of the inbound traffic.

IngressRules.N.DestinationPortRange String No 80/120

The destination port range of the inbound traffic. Valid values: 1 to 65535. Separate the first port and last port with a forward slash (/), for example, 1/200 or 80/80. A value of -1/-1 indicates that all ports are available. Therefore, do not set the value to -1/-1.

Note When IngressRules.N.Protocol is set to ICMP, ignore this parameter.
IngressRules.N.SourcePortRange String No 80/120

The source port range of the inbound traffic. Valid values: 1 to 65535. Separate the first port and last port with a forward slash (/), for example, 1/200 or 80/80. A value of -1/-1 indicates that all ports are available. Therefore, do not set the value to -1/-1.

Note When IngressRules.N.Protocol is set to ICMP, ignore this parameter.
EgressRules.N.Priority Integer No 1

The priority of the outbound rule. A smaller value indicates a higher priority. The maximum value of N is 10, which indicates that you can configure at most 10 outbound rules for a filter.

EgressRules.N.Action String No accept

The collection policy of the outbound rule. Valid values:

  • accept: collects network traffic.
  • drop: does not collect network traffic.
EgressRules.N.Protocol String No TCP

The transport protocol used by outbound traffic that needs to be mirrored. Valid values:

  • ALL: all protocols
  • ICMP: ICMP
  • TCP: TCP
  • UDP: UDP
EgressRules.N.DestinationCidrBlock String No 10.0.0.0/24

The destination CIDR block of the outbound traffic.

EgressRules.N.SourceCidrBlock String No 10.0.0.0/24

The source CIDR block of the outbound traffic.

EgressRules.N.DestinationPortRange String No 22/40

The destination CIDR block of the outbound traffic. Valid values: 1 to 65535. Separate the first port and last port with a forward slash (/), for example, 1/200 or 80/80. A value of -1/-1 indicates that all ports are available. Therefore, do not set the value to -1/-1.

Note When EgressRules.N.Protocol is set to ICMP, ignore this parameter.
EgressRules.N.SourcePortRange String No 22/40

The source port range of the outbound traffic. Valid values: 1 to 65535. Separate the first port and last port with a forward slash (/), for example, 1/200 or 80/80. A value of -1/-1 indicates that all ports are available. Therefore, do not set the value to -1/-1.

Note When EgressRules.N.Protocol is set to ICMP, ignore this parameter.

Response parameters

Parameter Type Example Description
EgressRules Array of EgressRule

The list of outbound rules.

InstanceId String tmr-j6cok23ugp53eeib5****

The ID of the outbound rule.

IngressRules Array of IngressRule

The list of inbound rules.

InstanceId String tmr-j6c6rtallo51ouzv3****

The ID of the inbound rule.

RequestId String 07F272E2-6AD5-433A-8207-A607C76F1676

The ID of the request.

Examples

Sample requests

http(s)://[Endpoint]/?Action=CreateTrafficMirrorFilterRules
&RegionId=cn-hongkong
&TrafficMirrorFilterId=tmf-j6cmls82xnc86vtpe****
&<Common request parameters>

Sample success responses

XML format

<CreateTrafficMirrorFilterRulesResponse>
  <RequestId>07F272E2-6AD5-433A-8207-A607C76F1676</RequestId>
  <EgressRules>
        <InstanceId>tmr-j6cok23ugp53eeib5****</InstanceId>
  </EgressRules>
  <IngressRules>
        <InstanceId>tmr-j6c6rtallo51ouzv3****</InstanceId>
  </IngressRules>
</CreateTrafficMirrorFilterRulesResponse>

JSON format

{
    "RequestId": "07F272E2-6AD5-433A-8207-A607C76F1676",
    "EgressRules": {
        "InstanceId": "tmr-j6cok23ugp53eeib5****"
    },
    "IngressRules": {
        "InstanceId": "tmr-j6c6rtallo51ouzv3****"
    }
}

Error codes

HttpCode Error code Error message Description
400 ResourceNotFound.TrafficMirrorFilter The specified resource of traffic mirror filter is not found. The error message returned because the specified filter does not exist.
400 IncorrectStatus.TrafficMirrorFilter The status of traffic mirror filter is incorrect. The error message returned because the specified filter is in an invalid state.
400 IncorrectStatus.TrafficMirrorSession The status of traffic mirror session is incorrect. The error message returned because the traffic mirror session is in an invalid state.
400 QuotaExceeded.TrafficMirrorRulesPerFilter The quota of the number of traffic mirror rules per filter is exceeded. The error message returned because the number of rules associated with the filter has reached the upper limit.
400 DuplicatedParam.Priority The specified priority conflicts with the existing priority. The error message returned because the specified priority is the same as an existing one.
400 UnsupportedRegion The feature is not supported in current region. The error message returned because this feature is not supported in the current region.

For a list of error codes, visit the API Error Center.