When the SPAN port mirroring configuration is removed, the SPAN port mirroring still working but ONLY for egress traffic.

Topology:

• Eth0 is memeber of bond0 interface.
• Eth1 is the port mirroring where the traffic is sent to the MonitorServer.

IP_Information

• 192.168.10.1 --> eth0 VyOSRouter
• 192.168.10.2 --> eth0 Generator

REPLICATION

After deleting the mirroring configuration:

delete interface bonding bond0 mirror

We can observe eth1 (the old port mirroring) still sending the EGRESSING traffic from bond0 interface.

Checked the traffic control filters (tc) and return in blank:

However, it seems some internal rules or filters are referencing the qdisc.

sdasd

vyos@VyosRouter# tc qdisc show dev bond0 root
qdisc prio 1: root refcnt 17 bands 3 priomap 1 2 2 2 1 2 0 0 1 1 1 1 1 1 1 1

the refcnt 17 is the reference count

Finally I was able to fix this unexpected behavior by removing the root qdisc and resetting it to the default (pfifo_fast)

This command might impact QoS and shaping rules tied to the qdisc in question:

tc qdisc del dev bond0 root