topic Re: EXOS Packet Capture in ExtremeSwitching (EXOS/Switch Engine)

EXOS Packet Capture

Stefan_K_ — Tue, 18 May 2021 20:00:12 GMT

Hello,

today I played around with the built-in packet capture of EXOS ( How To: How to perform a local packet capture on an EXOS switch | Extreme Portal (force.com) )

I’m able to capture packets and open the pcap file with wireshark, but I only see the following packets:

Wondering if I’m doing something wrong or if the feature is something else than I’m thinking. Any hints?

Best regards
Stefan

Re: EXOS Packet Capture

CThompsonEXOS — Tue, 18 May 2021 20:05:32 GMT

Are you on 30.x or newer? IIRC some bytes need to be stripped to be read properly if so.

Generally it’s used for troubleshooting and debugging:

Be Aware!
Debug commands are primarily meant for trouble shooting purposes and are NOT part of any EXOS validation tests (regression).
The usage of any debug command can result in unexpected side-effects (like memory depletion, high CPU, process failures).

Is there a certain type of traffic you are trying to capture?

Thanks,

Chris Thompson

Re: EXOS Packet Capture

Stefan_K_ — Tue, 18 May 2021 20:17:03 GMT

Hi Chris,

thanks for your quick reply! I’m on 30.7.1.1-patch1-86. Switch is an X460-G2. I’m just doing some testing of this feature and don’t want to capture any specific traffic for now. But we might need this feature in the near future. (Troubleshooting at a customers site)

Best regards
Stefan

Re: EXOS Packet Capture

CThompsonEXOS — Tue, 18 May 2021 22:54:31 GMT

Hi,

You can use the editcap tool to remove the first 52 bytes. Mine looked something like below from Powershell:

PS C:\Program Files\Wireshark> .\editcap.exe -C 52 editcap.pcap newpcap.pcap

syntax below:
PS C:\Program Files\Wireshark> .\editcap.exe -C 52 <original pcap filename> <new pcap filename>

Below is more on editcap:

https://www.wireshark.org/docs/man-pages/editcap.html

Before:

After:

Thanks,

Chris Thompson

Re: EXOS Packet Capture

Stefan_K_ — Wed, 19 May 2021 00:13:22 GMT

Hi Chris,

this worked like a charm, thank you very much! How much “trouble” some 52 bytes can cause… 🙂

Maybe this little information can be added to the GTAC articles?

Best regards
Stefan

Re: EXOS Packet Capture

CThompsonEXOS — Wed, 19 May 2021 00:51:59 GMT

Hi Stefan,

You bring upa good point(Stefan 1, Chris 0) so that article has been updated:

How To: How to perform a local packet capture on an EXOS switch | Extreme Portal (force.com)

Thanks again,

Chris Thompson

Re: EXOS Packet Capture

booflix — Tue, 17 Feb 2026 03:36:43 GMT

t sounds like the packet capture itself is working since you’re able to generate the pcap file and open it in Wireshark. If you’re only seeing a very limited set of packets Wooflix (for example control-plane traffic like ARP, STP, LLDP, etc.), then it’s likely not a malfunction but rather how the built-in capture on ExtremeXOS (EXOS) is designed to operate.

Re: EXOS Packet Capture

booflix — Sat, 14 Mar 2026 04:12:41 GMT

It sounds like the packet capture itself is working since you’re able to export the Cineby pcap file and open it in Wireshark. In many cases with EXOS, seeing only a limited set of packets usually means the capture point or filter is restricting what the switch mirrors to the capture process. By default, the built-in capture may only see traffic that is processed by the CPU (control-plane traffic) rather than all data-plane traffic passing through the ports.

Re: EXOS Packet Capture

booflix — Mon, 16 Mar 2026 17:31:54 GMT

from what you’re describing, it doesn’t sound like you’re doing anything wrong—it’s more about how the EXOS packet capture feature actually works under the hood. Flixtor The built-in capture on EXOS switches is fairly limited compared to something like a full span/mirror session feeding into Wireshark.

In many cases, EXOS captures are restricted to CPU-bound traffic (control plane) rather than full data plane forwarding. That means you’ll mostly see things like ARP, LLDP, STP, or other management/control packets, which would explain why your capture looks “incomplete” or not what you expected.

Re: EXOS Packet Capture

booflix — Tue, 17 Mar 2026 16:57:21 GMT

From what you described, it sounds like the packet capture itself is working, since you’re able to export the pcap file and open it in Wireshark. When only a limited or unusual set of packets appears, Flixer it’s often related to where the capture is attached or what traffic actually passes through that point on the switch.

Re: EXOS Packet Capture

booflix — Wed, 22 Apr 2026 19:42:41 GMT

It sounds like the capture itself is working since you’re able to open the file in Wireshark, but the fact that you’re only seeing a limited or unexpected set of packets usually points to how (and where) the capture is being performed on EXOS.

One thing to keep in mind is that the built-in packet capture on EXOS doesn’t always behave like a full mirror/SPAN port. Depending on the configuration, it may only capture control-plane traffic or packets destined to/from the switch CPU, rather than all transit traffic on a port or VLAN. That could explain why your capture looks incomplete. Visit

Re: EXOS Packet Capture

booflix — Sun, 26 Apr 2026 18:18:42 GMT

It sounds like you’ve successfully captured traffic, but what you’re seeing in Wireshark suggests the capture might be limited in scope rather than “full” packet visibility. EXOS GMovies packet capture is often interface- and filter-dependent, so if you’re only seeing a small subset of frames (like control or broadcast traffic), it could be due to the capture point, VLAN context, or applied filters.

Re: EXOS Packet Capture

NolanR — Wed, 08 Jul 2026 19:47:53 GMT

This was an enjoyable read from beginning to end. The explanations were straightforward, the examples felt relevant, and I finished with a much better understanding of the subject overall.
Visit

Re: EXOS Packet Capture

booflix — Mon, 20 Jul 2026 03:34:44 GMT

Hi Stefan,

It looks like you're only capturing control-plane traffic rather than the data-plane packets you're expecting. A few things you might want to check:

Verify that you're capturing on the correct VLAN or interface.
Make sure you've applied the appropriate capture filters (or removed overly restrictive ones).
Keep in mind that EXOS local packet capture has some platform-specific limitations. On certain switch models, it only captures packets processed by the CPU, not hardware-switched traffic passing through the ASIC. AZ Movies
If your goal is to inspect transit traffic, you may need to configure port mirroring (SPAN) and capture the traffic from the mirrored port using an external device running Wireshark.

Could you share your switch model, EXOS version, and the exact capture command you used? That would make it easier to determine whether you're hitting a platform limitation or a configuration issue.

Re: EXOS Packet Capture

booflix — Wed, 22 Jul 2026 04:43:13 GMT

This is an interesting question because the built-in packet capture feature can be a bit confusing at first. If you're only seeing those packets in Wireshark, it may be related to the capture point, applied filters, or hardware offloading rather than the traffic itself. Checking the interface configuration and testing with a known traffic Gomovies flow could help narrow down the cause. I'd be interested to know what the final solution was, as it could be useful for anyone troubleshooting EXOS packet captures in the future.

Re: EXOS Packet Capture

booflix — Tue, 28 Jul 2026 03:36:32 GMT

It sounds like the packet capture itself is working since you're able to open the PCAP in Wireshark, but the limited traffic suggests the capture point or filter may not be where you expect it to be. Himovies On EXOS, local packet captures can have certain limitations depending on the interface, VLAN, ASIC offloading, or whether the traffic is hardware-switched rather than CPU-bound.

Re: EXOS Packet Capture

booflix — Sun, 02 Aug 2026 17:54:23 GMT

Thanks for sharing this, Stefan. The packet capture output is interesting, and I think the key point is understanding exactly where and how EXOS is capturing the traffic. If Wireshark is only showing a limited set of packets, it would be worth checking the capture filters, source/interface configuration, Solarmovies VLAN or port settings, and whether the expected traffic is actually passing through the capture point. A comparison with a known active traffic flow could also help determine whether this is expected EXOS behavior or a configuration issue. Great example of how useful packet captures can be for troubleshooting!