EXOS Packet Capture

[Stefan_K_]

Hello,

today I played around with the built-in packet capture of EXOS ( How To: How to perform a local packet capture on an EXOS switch | Extreme Portal (force.com) )

I’m able to capture packets and open the pcap file with wireshark, but I only see the following packets:

Wondering if I’m doing something wrong or if the feature is something else than I’m thinking. Any hints?

Best regards
Stefan

[CThompsonEXOS · Accepted solution]

Hi,

You can use the editcap tool to remove the first 52 bytes.  Mine looked something like below from Powershell:

PS C:\Program Files\Wireshark> .\editcap.exe -C 52 editcap.pcap newpcap.pcap

syntax below:
PS C:\Program Files\Wireshark> .\editcap.exe -C 52 <original pcap filename> <new pcap filename>

Below is more on editcap:

https://www.wireshark.org/docs/man-pages/editcap.html

Before:

After:

Thanks,

Chris Thompson

[booflix]

Thanks for sharing this, Stefan. The packet capture output is interesting, and I think the key point is understanding exactly where and how EXOS is capturing the traffic. If Wireshark is only showing a limited set of packets, it would be worth checking the capture filters, source/interface configuration, Solarmovies VLAN or port settings, and whether the expected traffic is actually passing through the capture point. A comparison with a known active traffic flow could also help determine whether this is expected EXOS behavior or a configuration issue. Great example of how useful packet captures can be for troubleshooting!

[booflix · Accepted solution]

This is an interesting question because the built-in packet capture feature can be a bit confusing at first. If you're only seeing those packets in Wireshark, it may be related to the capture point, applied filters, or hardware offloading rather than the traffic itself. Checking the interface configuration and testing with a known traffic Gomovies flow could help narrow down the cause. I'd be interested to know what the final solution was, as it could be useful for anyone troubleshooting EXOS packet captures in the future.

[booflix]

Hi Stefan,

It looks like you're only capturing control-plane traffic rather than the data-plane packets you're expecting. A few things you might want to check:

• Verify that you're capturing on the correct VLAN or interface.
• Make sure you've applied the appropriate capture filters (or removed overly restrictive ones).
• Keep in mind that EXOS local packet capture has some platform-specific limitations. On certain switch models, it only captures packets processed by the CPU, not hardware-switched traffic passing through the ASIC. AZ Movies
• If your goal is to inspect transit traffic, you may need to configure port mirroring (SPAN) and capture the traffic from the mirrored port using an external device running Wireshark.

Could you share your switch model, EXOS version, and the exact capture command you used? That would make it easier to determine whether you're hitting a platform limitation or a configuration issue.

[NolanR]

This was an enjoyable read from beginning to end. The explanations were straightforward, the examples felt relevant, and I finished with a much better understanding of the subject overall.
Visit