EXOS Packet Capture

[Stefan_K_]

Hello,

today I played around with the built-in packet capture of EXOS ( How To: How to perform a local packet capture on an EXOS switch | Extreme Portal (force.com) )

I’m able to capture packets and open the pcap file with wireshark, but I only see the following packets:

Wondering if I’m doing something wrong or if the feature is something else than I’m thinking. Any hints?

Best regards
Stefan

[CThompsonEXOS · Accepted solution]

Hi,

You can use the editcap tool to remove the first 52 bytes.  Mine looked something like below from Powershell:

PS C:\Program Files\Wireshark> .\editcap.exe -C 52 editcap.pcap newpcap.pcap

syntax below:
PS C:\Program Files\Wireshark> .\editcap.exe -C 52 <original pcap filename> <new pcap filename>

Below is more on editcap:

https://www.wireshark.org/docs/man-pages/editcap.html

Before:

After:

Thanks,

Chris Thompson

[booflix]

It sounds like the packet capture is working, but you may be capturing traffic on the CPU rather than seeing all packets traversing the switch port. EXOS local packet capture has some limitations compared to a traditional SPAN/mirror session, so the results can be surprising if you're expecting to see all forwarded traffic. https://movies7tv.com/

[booflix]

This is a useful discussion for anyone troubleshooting networks with EXOS. Being able to capture traffic directly on the switch and inspect the resulting PCAP Movies2Watch in Wireshark is extremely helpful, but seeing only limited packet types can understandably raise questions about the capture configuration.

[booflix]

Thanks for sharing this, Stefan. The packet capture output is interesting, and I think the key point is understanding exactly where and how EXOS is capturing the traffic. If Wireshark is only showing a limited set of packets, it would be worth checking the capture filters, source/interface configuration, Solarmovies VLAN or port settings, and whether the expected traffic is actually passing through the capture point. A comparison with a known active traffic flow could also help determine whether this is expected EXOS behavior or a configuration issue. Great example of how useful packet captures can be for troubleshooting!

[booflix · Accepted solution]

This is an interesting question because the built-in packet capture feature can be a bit confusing at first. If you're only seeing those packets in Wireshark, it may be related to the capture point, applied filters, or hardware offloading rather than the traffic itself. Checking the interface configuration and testing with a known traffic Gomovies flow could help narrow down the cause. I'd be interested to know what the final solution was, as it could be useful for anyone troubleshooting EXOS packet captures in the future.