topic RE: command for local packet capture on x460 v16 in ExtremeSwitching (EXOS/Switch Engine)

command for local packet capture on x460 v16

Kaon_Thana — Tue, 25 Oct 2016 01:48:00 GMT

Found this article but this command doesnt exist:
https://extremeportal.force.com/ExtrArticleDetail?an=000082238

RE: command for local packet capture on x460 v16

StephenW — Tue, 25 Oct 2016 01:54:00 GMT

It does. But the command is hidden and you can't tab through it.

RE: command for local packet capture on x460 v16

Kaon_Thana — Tue, 25 Oct 2016 02:01:00 GMT

I see thanks. I tried this:

debug packet capture ports 48 on print-to-console

And got no result. How can I view the packets on a specific port?

RE: command for local packet capture on x460 v16

StephenW — Tue, 25 Oct 2016 02:04:00 GMT

debug packet capture ports 48 on print-to-console Make sure your on console.

RE: command for local packet capture on x460 v16

StephenW — Tue, 25 Oct 2016 02:09:00 GMT

This is better. "debug packet capture ports 48 on count 100 file-name pcap_capture"

It captures 100 packets and places them in a .pcap file called pcap_capture.pcap in /usr/local/tmp on the switch.

ls /usr/local/tmp

RE: command for local packet capture on x460 v16

Kaon_Thana — Tue, 25 Oct 2016 02:15:00 GMT

Thanks! Is there a built in command to view the file without using TFTP to upload it somewhere?

'cat' doesn't work

RE: command for local packet capture on x460 v16

Edward_Tsui — Tue, 25 Oct 2016 07:27:00 GMT

As far as I know, there is no built-in tool to view the content, all you need is to TFTP it to somewhere and open with wireshark

RE: command for local packet capture on x460 v16

StephenW — Tue, 25 Oct 2016 07:31:00 GMT

You have to upload it to a TFTP server. If you have Console access you can use my first command. It will display the packets to the console.

RE: command for local packet capture on x460 v16

davidj_cogliane — Wed, 26 Oct 2016 18:15:00 GMT

I am not sure what started the debate around our office, but I am hoping someone can clear it up.

Does this packet capture method capture all traffic or just traffic that hits the cpu? I see that ingress and egress have to be captured separately, but will we see all ingress or egress traffic?

Thanks,

RE: command for local packet capture on x460 v16

Erik_Auerswald — Wed, 26 Oct 2016 18:43:00 GMT

Hi David,

that is a good question, I do not know the answer either. If I remember correctly, older EXOS versions (15.1, 15.3) allowed capture of traffic hitting the CPU only. The interface name used for this contained "bcm", I think.

The GTAC Knowledge article mentioned above pertains to EXOS 15.4 and later and uses EXOS front-port names.

Looking forward to an authoritative answer. 🙂

Erik

BTW there is an article to capture management port traffic as well: How do i take a packet capture of the management port?

RE: command for local packet capture on x460 v16

StephenW — Wed, 26 Oct 2016 20:45:00 GMT

I was told when you start capturing on a port with "debug packet" an internal ACL is created to kick the port traffic to CPU, and it's captured from the CPU.

RE: command for local packet capture on x460 v16

Kaon_Thana — Wed, 26 Oct 2016 21:23:00 GMT

When I ran the above "debug packet capture" command I was not able to see traffic like pings/udp going through the port. I only saw this traffic after I enabled a port mirror to another server on the switch.