EXOS Packet Capture

[Stefan_K_]

Hello,

today I played around with the built-in packet capture of EXOS ( How To: How to perform a local packet capture on an EXOS switch | Extreme Portal (force.com) )

I’m able to capture packets and open the pcap file with wireshark, but I only see the following packets:

Wondering if I’m doing something wrong or if the feature is something else than I’m thinking. Any hints?

Best regards
Stefan

[CThompsonEXOS · Accepted solution]

Hi,

You can use the editcap tool to remove the first 52 bytes.  Mine looked something like below from Powershell:

PS C:\Program Files\Wireshark> .\editcap.exe -C 52 editcap.pcap newpcap.pcap

syntax below:
PS C:\Program Files\Wireshark> .\editcap.exe -C 52 <original pcap filename> <new pcap filename>

Below is more on editcap:

https://www.wireshark.org/docs/man-pages/editcap.html

Before:

After:

Thanks,

Chris Thompson

[booflix]

This is a really interesting look at the built-in packet capture capabilities of EXOS. Being able to collect traffic directly from the switch and then inspect the resulting PCAP 24Drama  in Wireshark is extremely useful for troubleshooting. However, seeing only a limited set of packets can definitely raise questions about the capture configuration, filters, or which traffic the switch is actually exposing. It would be great to see what settings were used and what needs to be adjusted to capture the expected traffic. 

[booflix]

Interesting! The built-in packet capture feature in EXOS seems useful for troubleshooting network issues. If Wireshark is only showing a limited set of packets, it would be worth checking the capture filters, interface configuration, and whether the traffic you want to analyze is actually passing through the monitored port. Hopefully, a few adjustments will help reveal the missing traffic and make the packet analysis more useful. https://brocoflix.watch/

[booflix]

Thanks for sharing this. I’ve run into similar behavior with built-in packet captures on switches. If Wireshark is only showing a limited set of packets, it may be related to the capture interface, Ymovies filter settings, or the point in the forwarding path where EXOS is collecting the traffic.

[booflix]

It sounds like the packet capture is working, but you may be capturing traffic on the CPU rather than seeing all packets traversing the switch port. EXOS local packet capture has some limitations compared to a traditional SPAN/mirror session, so the results can be surprising if you're expecting to see all forwarded traffic. https://movies7tv.com/

[booflix]

This is a useful discussion for anyone troubleshooting networks with EXOS. Being able to capture traffic directly on the switch and inspect the resulting PCAP Movies2Watch in Wireshark is extremely helpful, but seeing only limited packet types can understandably raise questions about the capture configuration.