Solved

EXOS Packet Capture

  • 18 May 2021
  • 5 replies
  • 108 views

Userlevel 6
Badge

Hello,

today I played around with the built-in packet capture of EXOS ( How To: How to perform a local packet capture on an EXOS switch | Extreme Portal (force.com) )

I’m able to capture packets and open the pcap file with wireshark, but I only see the following packets:

Wondering if I’m doing something wrong or if the feature is something else than I’m thinking. Any hints?

Best regards
Stefan

icon

Best answer by Christopher Thompson 18 May 2021, 17:54

Hi,

You can use the editcap tool to remove the first 52 bytes.  Mine looked something like below from Powershell:

PS C:\Program Files\Wireshark> .\editcap.exe -C 52 editcap.pcap newpcap.pcap

syntax below:
PS C:\Program Files\Wireshark> .\editcap.exe -C 52 <original pcap filename> <new pcap filename>

Below is more on editcap:

https://www.wireshark.org/docs/man-pages/editcap.html

Before:

 

After:

 

Thanks,

Chris Thompson

View original

5 replies

Userlevel 4

Are you on 30.x or newer?  IIRC some bytes need to be stripped to be read properly if so.  

 

Generally it’s used for troubleshooting and debugging:

Be Aware!
Debug commands are primarily meant for trouble shooting purposes and are NOT part of any EXOS validation tests (regression).
The usage of any debug command can result in unexpected side-effects (like memory depletion, high CPU, process failures).

Is there a certain type of traffic you are trying to capture?

Thanks,

Chris Thompson

Userlevel 6
Badge

Hi Chris,

thanks for your quick reply! I’m on 30.7.1.1-patch1-86. Switch is an X460-G2. I’m just doing some testing of this feature and don’t want to capture any specific traffic for now. But we might need this feature in the near future. (Troubleshooting at a customers site)

Best regards
Stefan

Userlevel 4

Hi,

You can use the editcap tool to remove the first 52 bytes.  Mine looked something like below from Powershell:

PS C:\Program Files\Wireshark> .\editcap.exe -C 52 editcap.pcap newpcap.pcap

syntax below:
PS C:\Program Files\Wireshark> .\editcap.exe -C 52 <original pcap filename> <new pcap filename>

Below is more on editcap:

https://www.wireshark.org/docs/man-pages/editcap.html

Before:

 

After:

 

Thanks,

Chris Thompson

Userlevel 6
Badge

Hi Chris,

this worked like a charm, thank you very much! How much “trouble” some 52 bytes can cause… :)

Maybe this little information can be added to the GTAC articles?

 

Best regards
Stefan

Userlevel 4

Hi Stefan,

You bring upa good point(Stefan 1, Chris 0) so that article has been updated:

 

How To: How to perform a local packet capture on an EXOS switch | Extreme Portal (force.com)

 

Thanks again,

Chris Thompson

Reply