topic Re: EXOS Packet Capture in ExtremeSwitching (EXOS/Switch Engine)

EXOS Packet Capture

Stefan_K_ — Tue, 18 May 2021 20:00:12 GMT

Hello,

today I played around with the built-in packet capture of EXOS ( How To: How to perform a local packet capture on an EXOS switch | Extreme Portal (force.com) )

I’m able to capture packets and open the pcap file with wireshark, but I only see the following packets:

Wondering if I’m doing something wrong or if the feature is something else than I’m thinking. Any hints?

Best regards
Stefan

Re: EXOS Packet Capture

CThompsonEXOS — Tue, 18 May 2021 20:05:32 GMT

Are you on 30.x or newer? IIRC some bytes need to be stripped to be read properly if so.

Generally it’s used for troubleshooting and debugging:

Be Aware!
Debug commands are primarily meant for trouble shooting purposes and are NOT part of any EXOS validation tests (regression).
The usage of any debug command can result in unexpected side-effects (like memory depletion, high CPU, process failures).

Is there a certain type of traffic you are trying to capture?

Thanks,

Chris Thompson

Re: EXOS Packet Capture

Stefan_K_ — Tue, 18 May 2021 20:17:03 GMT

Hi Chris,

thanks for your quick reply! I’m on 30.7.1.1-patch1-86. Switch is an X460-G2. I’m just doing some testing of this feature and don’t want to capture any specific traffic for now. But we might need this feature in the near future. (Troubleshooting at a customers site)

Best regards
Stefan

Re: EXOS Packet Capture

CThompsonEXOS — Tue, 18 May 2021 22:54:31 GMT

Hi,

You can use the editcap tool to remove the first 52 bytes. Mine looked something like below from Powershell:

PS C:\Program Files\Wireshark> .\editcap.exe -C 52 editcap.pcap newpcap.pcap

syntax below:
PS C:\Program Files\Wireshark> .\editcap.exe -C 52 <original pcap filename> <new pcap filename>

Below is more on editcap:

https://www.wireshark.org/docs/man-pages/editcap.html

Before:

After:

Thanks,

Chris Thompson

Re: EXOS Packet Capture

Stefan_K_ — Wed, 19 May 2021 00:13:22 GMT

Hi Chris,

this worked like a charm, thank you very much! How much “trouble” some 52 bytes can cause… 🙂

Maybe this little information can be added to the GTAC articles?

Best regards
Stefan

Re: EXOS Packet Capture

CThompsonEXOS — Wed, 19 May 2021 00:51:59 GMT

Hi Stefan,

You bring upa good point(Stefan 1, Chris 0) so that article has been updated:

How To: How to perform a local packet capture on an EXOS switch | Extreme Portal (force.com)

Thanks again,

Chris Thompson

Re: EXOS Packet Capture

booflix — Tue, 17 Feb 2026 03:36:43 GMT

t sounds like the packet capture itself is working since you’re able to generate the pcap file and open it in Wireshark. If you’re only seeing a very limited set of packets Wooflix (for example control-plane traffic like ARP, STP, LLDP, etc.), then it’s likely not a malfunction but rather how the built-in capture on ExtremeXOS (EXOS) is designed to operate.

Re: EXOS Packet Capture

booflix — Sat, 14 Mar 2026 04:12:41 GMT

It sounds like the packet capture itself is working since you’re able to export the Cineby pcap file and open it in Wireshark. In many cases with EXOS, seeing only a limited set of packets usually means the capture point or filter is restricting what the switch mirrors to the capture process. By default, the built-in capture may only see traffic that is processed by the CPU (control-plane traffic) rather than all data-plane traffic passing through the ports.

Re: EXOS Packet Capture

booflix — Mon, 16 Mar 2026 17:31:54 GMT

from what you’re describing, it doesn’t sound like you’re doing anything wrong—it’s more about how the EXOS packet capture feature actually works under the hood. Flixtor The built-in capture on EXOS switches is fairly limited compared to something like a full span/mirror session feeding into Wireshark.

In many cases, EXOS captures are restricted to CPU-bound traffic (control plane) rather than full data plane forwarding. That means you’ll mostly see things like ARP, LLDP, STP, or other management/control packets, which would explain why your capture looks “incomplete” or not what you expected.

Re: EXOS Packet Capture

booflix — Tue, 17 Mar 2026 16:57:21 GMT

From what you described, it sounds like the packet capture itself is working, since you’re able to export the pcap file and open it in Wireshark. When only a limited or unusual set of packets appears, Flixer it’s often related to where the capture is attached or what traffic actually passes through that point on the switch.

Re: EXOS Packet Capture

booflix — Wed, 22 Apr 2026 19:42:41 GMT

It sounds like the capture itself is working since you’re able to open the file in Wireshark, but the fact that you’re only seeing a limited or unexpected set of packets usually points to how (and where) the capture is being performed on EXOS.

One thing to keep in mind is that the built-in packet capture on EXOS doesn’t always behave like a full mirror/SPAN port. Depending on the configuration, it may only capture control-plane traffic or packets destined to/from the switch CPU, rather than all transit traffic on a port or VLAN. That could explain why your capture looks incomplete. Visit

Re: EXOS Packet Capture

booflix — Sun, 26 Apr 2026 18:18:42 GMT

It sounds like you’ve successfully captured traffic, but what you’re seeing in Wireshark suggests the capture might be limited in scope rather than “full” packet visibility. EXOS GMovies packet capture is often interface- and filter-dependent, so if you’re only seeing a small subset of frames (like control or broadcast traffic), it could be due to the capture point, VLAN context, or applied filters.