Use Packet Mirroring

You can use Packet Mirroring to mirror traffic to and from particular virtual machine (VM) instances. The collected traffic can help you detect security threats and monitor application performance. For details about Packet Mirroring, see Packet Mirroring.

Mirrored traffic is sent to VMs where you have installed appropriate software. For a list of vendors who supply software, see Packet Mirroring partner providers.

The following sections describe how to create and manage packet mirroring policies.

Limitations

Packet Mirroring can't mirror packets for Private Service Connect published services traffic.
For security reasons, Packet Mirroring doesn't mirror packets that are sent to the link-local IP address range 169.254.0.0/16. This range includes metadata requests from a VM to its metadata server.
Using a Google Kubernetes Engine (GKE) LoadBalancer Service as a packet mirroring collector is not supported.
If a packet mirroring policy might apply to collector instances, Packet Mirroring ignores them and doesn't mirror their traffic.

Before you begin

Before you create a packet mirroring policy, you must have the appropriate permissions. You must also create an internal passthrough Network Load Balancer to act as a collector destination. This internal passthrough Network Load Balancer requires an instance group so that its backend service can use the VMs as collector destinations.

Permissions

To create and manage packet mirroring policies, Google Cloud provides two roles that are related to Packet Mirroring:

compute.packetMirroringUser grants users permission to create, update, and delete packet mirroring policies. To use Packet Mirroring, users must have this role in projects where they create packet mirroring policies.
compute.packetMirroringAdmin grants users permission to mirror particular resources. Even if users have permission to create a packet mirroring policy, they still require permission to mirror related sources. Use this role in projects where the owner of a policy might not have any other permissions, for example, in Shared VPC scenarios.

For more information about using IAM roles, see Manage access to projects, folders, and organizations in the IAM documentation.

Create collector instances

Packet Mirroring requires an instance group of collector instances. For details about instance groups, see the following documentation: Create a new instance template and Create a MIG in a single zone.

Create an internal load balancer for Packet Mirroring

To enable Packet Mirroring, you must have an internal passthrough Network Load Balancer that can serve as a packet mirroring collector. The internal passthrough Network Load Balancer must meet the following requirements:

The internal passthrough Network Load Balancer's forwarding rule must have Packet Mirroring enabled when the rule is created. This status cannot be changed after the rule is created. You can use this forwarding rule to collect both IPv4 and IPv6 traffic.
The internal passthrough Network Load Balancer is in the same region as the instances that you're mirroring.
The internal passthrough Network Load Balancer's backend service must use a session affinity of NONE (5-tuple hash).
The internal passthrough Network Load Balancer's backend service must have backend subsetting disabled.

If your collector instances are not set up to respond to the health check that you've configured with your backend service, the health check can fail. Packets can still be mirrored in this case.

For more information about how to create an internal passthrough Network Load Balancer for Packet Mirroring, see Creating a load balancer for Packet Mirroring.

Configure firewall rules

To prepare your VPC network for Packet Mirroring traffic, do the following:

Ensure that collector instances in the load balancer's instance group can receive traffic from mirrored instances or from the IPv4 and IPv6 address ranges of mirrored instances. For example, to let collector instances receive IPv4 traffic from any VM, create a firewall rule with a source IPv4 address range of 0.0.0.0/0. To let collector instances receive IPv6 traffic from any VM, create a firewall rule with a source IPv6 address range of ::/0. To prevent internet traffic from reaching the collector instances, assign only internal IPv4 and IPv6 addresses to them.
Ensure that no other firewall rules override the implied egress rule so that mirrored traffic can flow from source instances to the destination instances that are part of the internal passthrough Network Load Balancer.
Ensure that collector instances can receive traffic from the Google Cloud health checking systems. For example, for IPv4 traffic, create a firewall rule that allows traffic to the collector instances from the IPv4 address ranges of 130.211.0.0/22 and 35.191.0.0/16. For IPv6 traffic, create a firewall rule that allows traffic to the collector instances from the IPv6 address range of 2600:2d00:1:b029::/64.
If you want to test Packet Mirroring by manually sending egress traffic from one or more mirrored instances, create a firewall rule that allows SSH traffic to those instances. For example, to allow SSH connections to your mirrored instances from all IPv4 and IPv6 addresses, allow ingress TCP traffic to port 22 from any source IPv4 and IPv6 address. If you want to only allow SSH connections that are initiated from a certain IPv4 or IPv6 address range, specify that IPv4 or IPv6 address range as a source range for the firewall rule. For more information about testing your internal passthrough Network Load Balancer, see Test load balancing.

If you don't have existing rules that allow this traffic, see Use VPC firewall rules to create them. For more information about creating firewall rules for an internal passthrough Network Load Balancer, see Configuring firewall rules in the Cloud Load Balancing documentation.

Create a packet mirroring policy

To start mirroring traffic to and from particular instances, create a packet mirroring policy. Google Cloud mirrors any instance that matches at least one of your specified sources.

Console

In the Google Cloud console, go to the Packet Mirroring page.

Go to Packet Mirroring
Click Create policy.
Enter the following information about the policy, and then click Continue.
1. Enter a name for the policy.
2. Select the region that includes the mirrored sources and collector destination. The packet mirroring policy must be in the same region as the source and destination.
3. Ignore the Priority field. It cannot be adjusted at present.
4. Select Enabled to activate the policy when you create it.
Select the VPC networks where the mirrored source and collector destination are located, and then click Continue.

The source and destination can be in the same or different VPC networks.
- If they are in the same VPC network, select Mirrored sources and destination are in the same VPC network, and then select the network.
- If they are in different networks, select Mirrored source and collector destination are in separate, peered VPC networks, and then select the mirrored source network and then the collector destination network.
Select mirrored sources, and then click Continue. You can select one or more sources. Google Cloud mirrors any instance that matches at least one of your selected sources.
- Subnets: select one or more subnetworks. Google Cloud mirrors existing and future instances in selected subnets.
- Network tag: specify one or more network tags. Google Cloud mirrors instances that have at least one of the specified tags.
- Instance name: select specific instances to mirror.
Select an internal passthrough Network Load Balancer that has been configured for Packet Mirroring, and then click Continue. Google Cloud sends mirrored traffic to instances that are behind the internal passthrough Network Load Balancer.

For Shared VPC, if the collector destination and mirrored sources are in the same Shared VPC network, you must select the project where the collector destination is located, and then you select a load balancer.
To select the traffic to mirror, do the following:
- To mirror all IPv4 traffic, select Mirror all IPv4 traffic (default).
- To mirror all IPv4 and IPv6 traffic, select Mirror filtered traffic, and then do the following:
  - Select Allow all protocols.
  - Select Allow all IPv4 ranges (0.0.0.0/0).
  - Select Allow all IPv6 ranges (::/0).
  - Select Allow both ingress and egress traffic.
- To limit the traffic that's mirrored, select Mirror filtered traffic, and then do the following:
  - To limit mirrored traffic by protocol, select Allow specific protocols, and then select the protocols. If you don't see a protocol that you want to mirror traffic for, select Other protocols, and then enter the protocol in the Other protocols field. Valid values are tcp, udp, esp, ah, ipip, sctp, or an IANA protocol number. To specify ICMP for IPv6, enter 58.
  - For IPv4 range filters, do the following:
    - To mirror all IPv4 traffic, select Allow all IPv4 ranges (0.0.0.0/0).
    - To mirror traffic for specific IPv4 address ranges, select Allow specific IPv4 ranges. In the IPv4 ranges field, type a single IPv4 address range, and then press Enter. You can add multiple IPv4 ranges by pressing Enter after each range that you type.
  - For IPv6 range filters, do the following:
    - To filter out all IPv6 traffic, select None.
    - To mirror all IPv6 traffic, select Allow all IPv6 ranges (::/0).
    - To mirror traffic for specific IPv6 address ranges, select Allow specific IPv6 ranges. In the IPv6 ranges field, type a single IPv6 address range, and then press Enter. You can add multiple IPv6 ranges by pressing Enter after each range that you type.
Select the Traffic direction of the traffic that you want to mirror.
To create the packet mirroring policy, click Submit.

gcloud

To create a packet mirroring policy, use the packet-mirrorings create command.

gcloud compute packet-mirrorings create POLICY_NAME \
    --region=REGION \
    --network=NETWORK_NAME \
    --collector-ilb=FORWARDING_RULE_NAME \
    [--mirrored-subnets=SUBNET,[SUBNET,...]] \
    [--mirrored-tags=TAG,[TAG,...]] \
    [--mirrored-instances=INSTANCE,[INSTANCE,...]] \
    [--filter-cidr-ranges=CIDR_RANGE,[CIDR_RANGE,...]] \
    [--filter-protocols=PROTOCOL,[PROTOCOL,...]] \
    [--filter-direction=DIRECTION]

Replace the following:

POLICY_NAME: the name of the packet mirroring policy.
REGION: the region where the mirrored sources and collector destination are located.
NETWORK_NAME: the network where the mirrored sources are located.
FORWARDING_RULE_NAME: the name of the forwarding rule that is configured as a mirroring collector. Google Cloud sends all mirrored traffic to the associated internal passthrough Network Load Balancer.
SUBNET: the name of one or more subnets to mirror. You can provide multiple subnets by using a comma-separated list. Google Cloud mirrors existing and future instances in the subnet.
TAG: one or more network tags. Google Cloud mirrors instances that have the network tag. You can provide multiple tags by using a comma-separated list.
INSTANCE: the fully qualified ID of one or more instances to mirror. You can provide multiple instances by using a comma-separated list.
CIDR_RANGE: one or more IPv4 or IPv6 CIDR ranges to mirror. If no CIDR ranges are specified, all IPv4 traffic that matches the specified protocols is mirrored. If neither CIDR ranges nor protocols are specified, all IPv4 traffic is mirrored. To mirror all IPv4 and IPv6 traffic, use 0.0.0.0/0,::/0. You can include both IPv4 and IPv6 CIDR ranges. You can provide multiple ranges by using a comma-separated list.
PROTOCOL: one or more protocols to mirror. Valid values are tcp, udp, icmp, esp, ah, ipip, sctp, or an IANA protocol number. If no protocols are specified, all traffic that matches the specified CIDR ranges is mirrored. If neither protocols nor CIDR ranges are specified, all IPv4 traffic is mirrored. To specify ICMP for IPv6, use 58. You can provide multiple protocols by using a comma-separated list.
DIRECTION: the direction of the traffic to mirror relative to the VM. By default, this is set to both, which means that both ingress and egress traffic is mirrored. You can restrict which packets are captured by specifying ingress to capture only ingress packets or egress to capture only egress packets.

Terraform

You can use a Terraform resource to create a packet mirroring policy.

resource "google_compute_packet_mirroring" "default" {
  region      = "europe-west1"
  name        = "my-mirroring"
  description = "My packet mirror"
  network {
    url = google_compute_network.ilb_network.id
  }
  collector_ilb {
    url = google_compute_forwarding_rule.default.id
  }
  mirrored_resources {
    tags = ["foo"]
    instances {
      url = google_compute_instance.vm_test.id
    }
  }
  filter {
    ip_protocols = ["tcp"]
    cidr_ranges  = ["0.0.0.0/0"]
    direction    = "BOTH"
  }
}

To learn how to apply or remove a Terraform configuration, see Basic Terraform commands.

API

To create a packet mirroring policy, make a POST request to the packetMirrorings.insert method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/packetMirrorings
{
  "name": "POLICY_NAME",
  "enable": "ENABLED",
  "network": {
    "url": "NETWORK_URL"
  },
  "priority": PRIORITY,
  "mirroredResources": {
    "subnetworks": [
      {
        "url": "SUBNET_URL"
      }
    ],
    "tags": [
      "TAG"
    ],
    "instances": [
      {
        "url": "INSTANCE"
      }
    ]
  },
  "collectorIlb": {
    "url": "FORWARDING_RULE_URL"
  },
  "filter": {
    "IPProtocols": [
      "PROTOCOL"
    ],
    "cidrRanges": [
      "CIDR_RANGE"
    ],
    "direction": "DIRECTION"
  }
}

Replace the following:

PROJECT_ID: the ID of the project to create the policy in.
REGION: the region where the mirrored sources and collector destination are located.
POLICY_NAME: the name of the packet mirroring policy.
ENABLED: whether or not this policy takes effect. Options are TRUE and FALSE. TRUE is the default.
NETWORK_URL: the URL of the network where the mirrored sources are located.
PRIORITY: the priority of the forwarding rule, which is used to break ties when there is more than one matching rule. The valid range is 0 to 65,535, and the default is 1,000.
SUBNET_URL: the URL of a subnet to mirror. Google Cloud mirrors existing and future instances in the subnet. You can provide multiple subnets by using a comma-separated list.
TAG: a network tag. Google Cloud mirrors instances that have the network tag. You can provide multiple tags by using a comma-separated list.
INSTANCE: the fully qualified ID of an instance to mirror. You can provide multiple instances by using a comma-separated list.
FORWARDING_RULE_URL: the URL of a forwarding rule that is configured as a mirroring collector. Google Cloud sends all mirrored traffic to the associated internal passthrough Network Load Balancer.
PROTOCOL: one or more protocols. Options are tcp, udp, icmp, esp, ah, ipip, sctp, or an IANA protocol number. If no protocols are specified, all traffic that matches the specified CIDR ranges is mirrored. If neither CIDR ranges nor protocols are specified, all IPv4 traffic is mirrored. To specify ICMP for IPv6, enter 58. You can provide multiple protocols by using the following form: "icmp", "udp".
CIDR_RANGE: one or more IPv4 or IPv6 CIDR ranges to mirror. If no CIDR ranges are specified, all IPv4 traffic that matches the specified protocols is mirrored. If neither CIDR ranges nor protocols are specified, all IPv4 traffic is mirrored. To mirror all IPv4 and IPv6 traffic, use "0.0.0.0/0", "::/0". You can include both IPv4 and IPv6 CIDR ranges. You can provide multiple CIDR ranges by using the following form: "192.0.2.0/24", "2001:0DB8::/32".
PROTOCOL: one or more protocols to mirror.
DIRECTION: the direction of traffic to mirror. Options are INGRESS, EGRESS, or BOTH. The default is BOTH.

Verify packet mirroring

To verify that your collector instances are correctly receiving mirrored traffic, you can use tcpdump.

Connect to a collector instance.
If the tcpdump command is not available, install it.
Identify your network interface:
```
ip address
```
In the list of network interfaces, find the name that is associated with your collector instance's primary internal IPv4 address—for example, ens4.
Start analyzing packets:
```
sudo tcpdump -i INTERFACE_NAME -f "host IP_ADDRESS"
```
Replace the following:
- INTERFACE_NAME: the interface name that you identified in step 3.
- IP_ADDRESS: the IPv4 address of a mirrored source VM.
To run the test, send traffic from the mirrored source VM—for example, by sending an ICMP ping. In the output of tcpdump, verify that you can see the expected traffic.

Modify a packet mirroring policy

You can update an existing policy to change details such as mirrored sources or collector destinations.

Console

In the Google Cloud console, go to the Packet Mirroring page.

Go to Packet Mirroring
From the list of packet mirroring policies, click the one that you want to edit.
On the policy details page, click Edit.
Edit the fields that you want to update. The console follows the same flow as the steps for when you create a policy. For information about each field, see Create a packet mirroring policy.

gcloud

To update an existing packet mirroring policy, use the packet-mirrorings update command.

gcloud compute packet-mirrorings update POLICY_NAME [--async] \
  [--collector-ilb=FORWARDING_RULE_NAME] [--description=DESCRIPTION] [--enable] \
  [--filter-direction=DIRECTION] [--region=REGION] \
  [--add-filter-cidr-ranges=[CIDR_RANGE,...] | --clear-filter-cidr-ranges \
    | --remove-filter-cidr-ranges=[CIDR_RANGE,...] \
    | --set-filter-cidr-ranges=[CIDR_RANGE,...]] \
  [--add-filter-protocols=[PROTOCOL,...] | --clear-filter-protocols \
    | --remove-filter-protocols=[PROTOCOL,...] \
    | --set-filter-protocols=[PROTOCOL,...]] \
  [--add-mirrored-instances=[INSTANCE,...] | --clear-mirrored-instances \
    | --remove-mirrored-instances=[INSTANCE,...] \
    | --set-mirrored-instances=[INSTANCE,...]] \
  [--add-mirrored-subnets=[SUBNET,...] | --clear-mirrored-subnets \
    | --remove-mirrored-subnets=[SUBNET,...] \
    | --set-mirrored-subnets=[SUBNET,...]] \
  [--add-mirrored-tags=[TAG,...] | --clear-mirrored-tags \
    | --remove-mirrored-tags=[TAG,...] | --set-mirrored-tags=[TAG,...]]

Replace the following:

POLICY_NAME: the name of the packet mirroring policy to modify.
FORWARDING_RULE_NAME: the name of the forwarding rule that is configured as a collector. Google Cloud sends all mirrored traffic to the associated internal passthrough Network Load Balancer.
DESCRIPTION: a description of the packet mirroring policy.
DIRECTION: the direction of traffic to apply the packet mirroring policy to. Options are egress, ingress, or both.
REGION: the region where the policy is located.
CIDR_RANGE: one or more IPv4 or IPv6 CIDR ranges to mirror. If no CIDR ranges are specified, all IPv4 traffic that matches the specified protocols is mirrored. If neither CIDR ranges nor protocols are specified, all IPv4 traffic is mirrored. To mirror all IPv4 and IPv6 traffic, use 0.0.0.0/0,::/0. You can include both IPv4 and IPv6 CIDR ranges. You can provide multiple ranges by using a comma-separated list.
PROTOCOL: one or more protocols to mirror. Valid values are tcp, udp, icmp, esp, ah, ipip, sctp, or an IANA protocol number. If no protocols are specified, traffic that matches the specified CIDR ranges is mirrored. If neither protocols nor CIDR ranges are specified, all IPv4 traffic is mirrored. To specify ICMP for IPv6, use 58. You can provide multiple protocols by using a comma-separated list.
INSTANCE: the fully qualified ID of one or more VM instances to mirror. You can provide multiple instances by using a comma-separated list.
SUBNET: one or more subnetworks. You can provide multiple subnetworks by using a comma-separated list. Google Cloud mirrors existing and future instances in the subnet.
TAG: one or more network tags. You can provide multiple tags by using a comma-separated list.

API

To update a packet mirroring policy, make a POST request to the packetMirrorings.patch method.

PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/packetMirrorings/POLICY_NAME
{
  "name": "POLICY_NAME",
  "description": "DESCRIPTION",
  "priority": "PRIORITY",
  "collectorIlb": {
    "url": "FORWARDING_RULE_URL"
  },
  "mirroredResources": {
    "subnetworks": [
      {
        "url": "SUBNET_URL"
      }
    ],
    "instances": [
      {
        "url": "INSTANCE_URL"
      }
    ],
    "tags": [
      "NETWORK_TAGS"
    ]
  },
  "filter": {
    "cidrRanges": [
      "CIDR_RANGE"
    ],
    "IPProtocols": [
      "PROTOCOL"
    ],
    "direction": "DIRECTION"
  },
  "enable": "ENABLED"
}

Replace the following:

PROJECT_ID: the ID of the project where the policy is located.
REGION: the region of the packet mirroring policy.
POLICY_NAME: the name of the packet mirroring policy to modify.
DESCRIPTION: an optional description of the policy.
PRIORITY: the policy's priority, which is used to break ties when there are multiple matching policies. The default value is 1,000. The valid range is 0 through 65,535.
FORWARDING_RULE_URL: the URL of a forwarding rule with Packet Mirroring enabled. Google Cloud sends all mirrored traffic to the associated internal passthrough Network Load Balancer.
SUBNET_URL: the URL of a subnetwork. Google Cloud mirrors existing and future instances in the subnet. You can provide multiple subnetworks by using a comma-separated list.
INSTANCE_URL: the URL of a VM instance to mirror. You can provide multiple instances by using a comma-separated list.
NETWORK_TAGS: a network tag. Google Cloud mirrors instances that have one or more network tags. You can provide multiple tags by using a comma-separated list.
CIDR_RANGE: one or more IPv4 or IPv6 CIDR ranges to mirror. If no CIDR ranges are specified, all IPv4 traffic that matches the specified protocols is mirrored. If neither CIDR ranges nor protocols are specified, all IPv4 traffic is mirrored. To mirror all IPv4 and IPv6 traffic, use "0.0.0.0/0", "::/0". You can include both IPv4 and IPv6 CIDR ranges. You can provide multiple CIDR ranges by using the following form: "192.0.2.0/24", "2001:DB8::/32".
IP_PROTOCOL: one or more protocols. Options are tcp, udp, icmp, esp, ah, ipip, sctp, or an IANA protocol number. If no protocols are specified, all traffic that matches the specified CIDR ranges is mirrored. If neither CIDR ranges nor protocols are specified, all IPv4 traffic is mirrored. To specify ICMP for IPv6, use 58. You can provide multiple protocols by using the following form: "icmp", "udp".
DIRECTION: the direction of traffic to mirror. Options are INGRESS, EGRESS, or BOTH. The default is BOTH.
ENABLED: indicates whether the policy is enabled or not. Options are TRUE or FALSE.

List packet mirroring policies

You can list packet mirroring policies to view existing policies.

Console

In the Google Cloud console, go to the Packet Mirroring page.

Go to Packet Mirroring

The Google Cloud console lists all of the policies in your project.

gcloud

To list packet mirroring policies that are in your project or for a particular region, use the packet-mirrorings list command.

gcloud compute packet-mirrorings list \
  [--filter="region:(REGION...)"]

Replace REGION with the name of the region that contains the policies to list.

API

To list existing packet mirroring policies in your project, make a GET request to the packetMirrorings.list method.

GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/aggregated/packetMirrorings

Replace PROJECT_ID with the ID of your project.

To list existing packet mirroring policies for a particular region, make a GET request to the packetMirrorings.list method.

GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/packetMirrorings

Replace the following:

PROJECT_ID: the ID of the project that contains the policies to list.
REGION: the region that contains the policies to list.

Describe a packet mirroring policy

You can describe a packet mirroring policy to view details such as the policy's filters.

Console

In the Google Cloud console, go to the Packet Mirroring page.

Go to Packet Mirroring
From the list of packet mirroring policies, select the policy that you want to view. The Google Cloud console shows the details of the policy that you selected.

gcloud

To describe a packet mirroring policy, use the packet-mirrorings describe command.

gcloud compute packet-mirrorings describe POLICY_NAME \
  --region=REGION \

Replace the following:

POLICY_NAME: the name of the packet mirroring policy to describe.
REGION: the region where the policy is located.

API

To describe a packet mirroring policy, make a GET request to the packetMirrorings.get method.

GET https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/packetMirrorings/POLICY_NAME

Replace the following:

PROJECT_ID: the ID of the project where the policy is located.
REGION: the region where the policy is located.
POLICY_NAME: the name of the packet mirroring policy to describe.

Disable or enable a packet mirroring policy

You can disable or enable a packet mirroring policy to stop or start collecting mirrored traffic.

Console

In the Google Cloud console, go to the Packet Mirroring page.

Go to Packet Mirroring
From the list of packet mirroring policies, select the one to disable or enable.
Click Disable or Enable.
Confirm by clicking Disable or Enable.

gcloud

To disable a packet mirroring policy, use the packet-mirrorings update command.

gcloud compute packet-mirrorings update POLICY_NAME \
  --region=REGION \
  --no-enable

Replace the following:

POLICY_NAME: the name of the packet mirroring policy to disable or enable.
REGION: the region where the policy is located.

To enable a packet mirroring policy, use the packet-mirrorings update command.

gcloud compute packet-mirrorings update POLICY_NAME \
  --region=REGION \
  --enable

Replace the following:

POLICY_NAME: the name of the packet mirroring policy to disable or enable.
REGION: the region where the policy is located.

API

To disable or enable an existing packet mirroring policy, make a PATCH request to the packetMirrorings.patch method.

PATCH https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/packetMirrorings/POLICY_NAME
{
  "enable": "FALSE|TRUE"
}

Replace the following:

PROJECT_ID: the ID of the project where the policy is located.
REGION: the region where the policy is located.
POLICY_NAME: the name of the packet mirroring policy to disable.

Delete a packet mirroring policy

You can delete a packet mirroring policy to remove it from your project. After you delete a policy, Google Cloud stops mirroring all traffic that is related to the policy.

Console

In the Google Cloud console, go to the Packet Mirroring page.

Go to Packet Mirroring
From the list of packet mirroring policies, select the one that you want to delete.
Click Delete.
Confirm by clicking Delete.

gcloud

To delete a packet mirroring policy, use the packet-mirrorings delete command.

gcloud compute packet-mirrorings delete POLICY_NAME \
  --region=REGION \

Replace the following:

POLICY_NAME: the name of the packet mirroring policy to delete.
REGION: the region where the policy is located.

API

To delete a packet mirroring policy, make a DELETE request to the packetMirrorings.delete method.

DELETE https://compute.googleapis.com/compute/v1/projects/PROJECT_ID/regions/REGION/packetMirrorings/POLICY_NAME

Replace the following:

PROJECT_ID: the ID of the project where the policy is located.
POLICY_NAME: the name of the packet mirroring policy to delete.
REGION: the region where the policy is located.

Troubleshooting

If your packet mirroring policy isn't collecting the intended mirrored traffic, check the following configurations:

Check that you have firewall rules that allow traffic from mirrored instances to the collector instances.
Check that your mirrored sources include or exclude the instances to mirror. For example, if you specify a subnet as a mirrored source, all existing and future instances in the subnet are mirrored. If you specify tags, only instances that have matching tags are mirrored.
Check that the packet mirroring filters aren't too broad or too narrow. You might have unintentionally configured filters to include or exclude certain traffic.
If you have configured a packet mirroring policy to collect IPv6 traffic, ensure that the sources of mirrored traffic are dual-stack VMs that are connected to dual-stack subnets.