HPE G EI Switch - A-Series Switches: How to Use the Packet Capture Utility

Transcription

1 HPE G EI Switch - A-Series Switches: How to Use the Packet Capture Utility Environment The packet capture utility can be used to capture packets that pass through the switch. Issue How can one use the packet capture utility to create a trace for a specific protocol? Cause Resolution In the following example, switch Rack4sw2 is configured to capture ICMP packets. A ping command is executed on switch Rack4sw3 with a destination of Rack4sw1. The packet capture buffer is saved to the file pcapbuffer.pcap and transferred to a tftp server. The configuration, verification, and testing associated with the diagram follows; ACL configuration display current-configuration configuration acl-adv acl number 3000 name ICMP-Only rule 0 permit icmp rule 5 deny ip ACL verification -----

2 display acl all Advanced ACL 3000, named ICMP-Only, 2 rules, ACL's step is 5 rule 0 permit icmp rule 5 deny ip Clear the packet capture buffer reset packet capture buffer Start the packet capture packet capture start acl 3000 length Display the packet capture status and note the packet count display packet capture status Current status : In process Mode : Linear Buffer size : (bytes) Buffer used : 0 (bytes) Max capture length : 1500 (bytes) ACL information : Basic or advanced IPv4 ACL 3000 Schedule datetime: Unspecified Upper limit of duration : Unspecified (seconds) Duration : 47 (seconds) Upper limit of packets : Unspecified Packets count : Send ICMP ping packet ping -c PING : 56 data bytes, press CTRL_C to break Reply from : bytes=56 Sequence=1 ttl=255 time=3 ms ping statistics packet(s) transmitted 1 packet(s) received 0.00% packet loss round-trip min/avg/max = 3/3/3 ms Display capture status and note the packet count display packet capture status Current status : In process Mode : Linear Buffer size : (bytes) Buffer used : 3056 (bytes) Max capture length : 1500 (bytes) ACL information : Basic or advanced IPv4 ACL 3000 Schedule datetime: Unspecified Upper limit of duration : Unspecified (seconds) Duration : 414 (seconds) Upper limit of packets : Unspecified Packets count : Stop the packet capture packet capture stop Verify capture information in the buffer -----

3 display packet capture buffer :47:57:491 Index 1 GE1/0/6 102 (original 102) Bytes captured b8 af 67 e0 d2 77 b8 af 67 e1 12 f f ff 01 eb 04 c0 a c0 a c e a2 6d 4a a 0b 0c 0d :47:57:492 Index 2 GE1/0/9 102 (original 102) Bytes captured b8 af 67 e1 12 f7 b8 af 67 e0 d f ff 01 3b dc c0 a c0 a c e a2 6d 4a a 0b 0c 0d Save the capture buffer to a file packet capture buffer save Info: The file pcapbuffer.pcap exists. Overwrite it? [Y/N]:y Transfer file to tftp server tftp tftp-server put pcapbuffer.pcap Resolved Host : tftp-server-> File will be transferred in binary mode Sending file to remote TFTP server. Please wait... TFTP: 260 bytes sent in 1 second(s). File uploaded successfully Open file with Wireshark and create text file No. Time Source Destination Protocol Length Info ICMP 102 Echo (ping) request id=0x085c, seq=1/256, ttl=255 Ethernet II, Src: Hewlett-_e1:12:f7 (b8:af:67:e1:12:f7), Dst: Hewlett-_e0:d2:77 (b8:af:67:e0:d2:77) Destination: Hewlett-_e0:d2:77 (b8:af:67:e0:d2:77) Address: Hewlett-_e0:d2:77 (b8:af:67:e0:d2:77) Source: Hewlett-_e1:12:f7 (b8:af:67:e1:12:f7) Address: Hewlett-_e1:12:f7 (b8:af:67:e1:12:f7) Type: 802.1Q Virtual LAN (0x8100) 802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: = Priority: Best Effort (default) (0) = CFI: Canonical (0) = ID: 1 Type: IP (0x0800) Internet Protocol Version 4, Src: ( ), Dst: ( ) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport)) = Differentiated Services Codepoint: Default (0x00) = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00) Total Length: 84 Identification: 0x474f (18255) Flags: 0x = Reserved bit: Not set = Don't fragment: Not set = More fragments: Not set Fragment offset: 0 Time to live: 255

4 Protocol: ICMP (1) Header checksum: 0xeb04 [correct] [Good: True] [Bad: False] Source: ( ) Destination: ( ) [Source GeoIP: Unknown] [Destination GeoIP: Unknown] Internet Control Message Protocol Type: 8 (Echo (ping) request) Code: 0 Checksum: 0x2974 [correct] Identifier (BE): 2140 (0x085c) Identifier (LE): (0x5c08) Sequence number (BE): 1 (0x0001) Sequence number (LE): 256 (0x0100) [Response In: 2] Data (56 bytes) e a2 6d 4a mJ a 0b 0c 0d 0e 0f a 1b 1c 1d 1e 1f !\"#$%&' a 2b 2c 2d 2e 2f ()*+,-./ Data: 2ea26d4a a0b0c0d0e0f... [Length: 56] No. Time Source Destination Protocol Length Info ICMP 102 Echo (ping) reply id=0x085c, seq=1/256, ttl=255 Ethernet II, Src: Hewlett-_e0:d2:77 (b8:af:67:e0:d2:77), Dst: Hewlett-_e1:12:f7 (b8:af:67:e1:12:f7) Destination: Hewlett-_e1:12:f7 (b8:af:67:e1:12:f7) Address: Hewlett-_e1:12:f7 (b8:af:67:e1:12:f7) Source: Hewlett-_e0:d2:77 (b8:af:67:e0:d2:77) Address: Hewlett-_e0:d2:77 (b8:af:67:e0:d2:77) Type: 802.1Q Virtual LAN (0x8100) 802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: = Priority: Best Effort (default) (0) = CFI: Canonical (0) = ID: 1 Type: IP (0x0800) Internet Protocol Version 4, Src: ( ), Dst: ( ) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport)) = Differentiated Services Codepoint: Default (0x00) = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00) Total Length: 84 Identification: 0xf677 (63095) Flags: 0x = Reserved bit: Not set = Don't fragment: Not set = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: ICMP (1) Header checksum: 0x3bdc [correct] [Good: True] [Bad: False] Source: ( ) Destination: ( ) [Source GeoIP: Unknown] [Destination GeoIP: Unknown] Internet Control Message Protocol Type: 0 (Echo (ping) reply) Code: 0

5 Checksum: 0x3174 [correct] Identifier (BE): 2140 (0x085c) Identifier (LE): (0x5c08) Sequence number (BE): 1 (0x0001) Sequence number (LE): 256 (0x0100) [Response To: 1] [Response Time: ms] Data (56 bytes) e a2 6d 4a mJ a 0b 0c 0d 0e 0f a 1b 1c 1d 1e 1f !\"#$%&' a 2b 2c 2d 2e 2f ()*+,-./ Data: 2ea26d4a a0b0c0d0e0f... [Length: 56] Physical interconnect Rack4sw2 GE2/0/9 b8af-67eb-d2ee GigabitEthernet1/0/9 Rack4sw3 GE1/0/6 b8af-67e1-12f6 GigabitEthernet2/0/6 Rack4sw1 GE1/0/9 b8af-67e0-d276 GigabitEthernet2/0/9 Rack4sw2 GE2/0/6 b8af-67eb-d2ee GigabitEthernet1/0/6