Cisco 7600 Packet_capture.ppt

《Cisco 7600 Packet_capture.ppt》由会员分享，可在线阅读，更多相关《Cisco 7600 Packet_capture.ppt（20页珍藏版）》请在淘文阁 - 分享文档赚钱的网站上搜索。

1、1 2005,Cisco Systems,Inc.All rights reserved.Packet Capture Packet CapturingBy:wyuFeb,2006 2001,Cisco Systems,Inc.All rights reserved.2 2001,Cisco Systems,Inc.All rights reserved.2 2005,Cisco Systems,Inc.All rights reserved.2Agenda1.Packet Capture Tools2.General Packet Capture Mode3.Capture Tips4.Us

2、ing 7600 ELAM 2001,Cisco Systems,Inc.All rights reserved.3 2001,Cisco Systems,Inc.All rights reserved.3 2005,Cisco Systems,Inc.All rights reserved.3Packet Capture/Analysis ToolsMost Commonly Used Packet Capture/Analysis ToolCommercial Equipment:Agilent,Ixia,Spirent,etc.PC based Software:Packet Sniff

3、er,Ethereal,TCPdump,etc.Cisco Proprietary:Pagent,ELAM 2001,Cisco Systems,Inc.All rights reserved.4 2001,Cisco Systems,Inc.All rights reserved.4 2005,Cisco Systems,Inc.All rights reserved.4General Packet Capture ModeContinuous Packet Capturing-Capture all packets that meets the condition that set by

4、users in a fixed packet buffer.-Packets are stored in the ring-type buffer and dropped in first-in first-out basis.Depending on the equipment vendor,capturing could stop whenever the packet buffer is full.-Packet buffer size can be adjusted by usersTriggered Packet Capturing-Packet capturing starts

5、only when triggered condition meets.-Capture stops after packet buffer is felt-Users might be able to set number of packets to be saved before trigger packets occurs 2001,Cisco Systems,Inc.All rights reserved.5 2001,Cisco Systems,Inc.All rights reserved.5 2005,Cisco Systems,Inc.All rights reserved.5

6、Capture TipsAlways set good filters-Eliminate unwanted packets begin capture and waste buffer memory-Narrowed the scope for what packets to look for-Be aware of promiscuous mode being set by default,especially in the Ethernet case,it capture everything on the wire.Ensure correct physical layer prope

7、rty setting and L2 Protocol-Eliminate the possibility for not being able to capture packets due to CRC or Scrambling incorrectly set-Set with correct L2 protocol,it helps the packet analyzer to decode packet with correct packet format as cases like encapsulation PPP/HDLC 2001,Cisco Systems,Inc.All r

8、ights reserved.6 2001,Cisco Systems,Inc.All rights reserved.6 2005,Cisco Systems,Inc.All rights reserved.6My favorite capture setupTrafficSourceUUTRemote EndFiber Splitter Capture ToolPackets capturedOn this way out 2001,Cisco Systems,Inc.All rights reserved.7 2001,Cisco Systems,Inc.All rights reser

9、ved.7 2005,Cisco Systems,Inc.All rights reserved.7Using 7600 ELAMWhats ELAM-ELAM Embedded Logic Analyzer Module-It is a EARL built-in logic analyzer that can be used as a packet capture tool for superman and tycho ASICsWhat can it do and how to use it?How to enable it?By configuring service internal

10、.Where can I use it?On any module that has an EARL7 ASIC complex.A Supervisor 720 or a DFC3 capable card.On which prompt do I start it?Either RP or SP prompt.How many packets can I capture?ONEHow do I find the packet that I need?By setting a trigger.How do I find out which ASICs are available?sh pla

11、tform capture system asicRemember,ELAM only captures on superman and tycho asic!2001,Cisco Systems,Inc.All rights reserved.8 2001,Cisco Systems,Inc.All rights reserved.8 2005,Cisco Systems,Inc.All rights reserved.8SUP720 ASICs Physical Location 2001,Cisco Systems,Inc.All rights reserved.9 2001,Cisco

12、 Systems,Inc.All rights reserved.9 2005,Cisco Systems,Inc.All rights reserved.97600 Logical Block Diagram 2001,Cisco Systems,Inc.All rights reserved.10 2001,Cisco Systems,Inc.All rights reserved.10 2005,Cisco Systems,Inc.All rights reserved.10SUP Complex:ASICs Superman L2 Forwarding ASIC EARL7 Tycho

13、 L3 Forwarding,Security and QoS ACL ASIC-EARL7 Super Solano 18 port Crossbar ASIC for the Sup720 that provides an aggregate bandwidth of 360 Gbps Pinnacle 4 port Gigabit ASIC Hyperion Fabric Interface and Multicast Replication ASIC;NextGen Titan&Medusa Combo Titan ASIC which does Layer 2/3 packet re

14、plication Medusa Crossbar&Bus Fabric ASIC for Constellation+and Super Constellation Systems 2001,Cisco Systems,Inc.All rights reserved.11 2001,Cisco Systems,Inc.All rights reserved.11 2005,Cisco Systems,Inc.All rights reserved.11ELAM CLI Optionscenta#show platform capture elam?asic select ELAM ASIC

15、data show capture data help helper for elam capture release release ELAM lock start start capture status show capture status trigger define ELAM trigger 2001,Cisco Systems,Inc.All rights reserved.12 2001,Cisco Systems,Inc.All rights reserved.12 2005,Cisco Systems,Inc.All rights reserved.12ELAM Usage

16、 Steps1.)Specify ASIC where you want to use ELAM ELAM support is per ASIC,not per system.To see which ASICs have ELAM support in a system use sh platform capture elam asic Example:harco#show platform capture elam asic Slot Cpu Asic Inst Ver PB Elam Active Lock-6 0 TYCHO 0 2.2 Y 60 SUPERMAN 0 1.3 Y *

17、2.)To select an actual ASIC use the use sh platform capture elam asic slot inst 2001,Cisco Systems,Inc.All rights reserved.13 2001,Cisco Systems,Inc.All rights reserved.13 2005,Cisco Systems,Inc.All rights reserved.13ELAM Usage Steps(Set Trigger)3.)Specify capture triggerMost challenging part of usi

18、ng ELAM is choosing the right trigger!CLI command to configure a trigger is sh platform capture elam trigger if Need to specify where the trigger will be applied:-DBUS to match on DBUS header-RBUS to match on RBUS header-DE to match on Tychos decision engineNeed to specify the packet format to be ca

19、ptured-IPv4,IPv6,OthersFinally specify an actual trigger after if.For list of available parameters use sh platform cap elam trigger help Note each asic/bus provides different set of triggers to match onTriggers from multiple ASICs cannot be mixed when using CLIWhen more than one trigger is specified

20、(separated by space)they are logically AND(i.e.all triggers should be true for packet to be captured).It is not possibly to logically OR the triggersAlso useful to see ENG-14749“Constellation Bus Specification”for definition of the DBUS/RBUS fieldsDbus Capture Sampleharco#show platform capture elam

21、trigger dbus ipv4 if ip_da=160.1.1.1255.255.255.255 2001,Cisco Systems,Inc.All rights reserved.14 2001,Cisco Systems,Inc.All rights reserved.14 2005,Cisco Systems,Inc.All rights reserved.14ELAM Usage Steps(Start Capturing)4.)Start capturing harco#show platform capture elam start 5.)View capture stat

22、usharco#show platform capture elam statu active ELAM info:Slot Cpu Asic Inst Ver PB Elam-6 0 SUPERMAN 0 1.3 Y DBUS trigger:FORMAT=IP L3_PROTOCOL=IPV4 IP_DA=160.1.1.1255.255.255.255elam capture in progress6.)View captured dataharco#show platform capture elam dataIt changes to CompleteWhen packet is c

23、aptured 2001,Cisco Systems,Inc.All rights reserved.15 2001,Cisco Systems,Inc.All rights reserved.15 2005,Cisco Systems,Inc.All rights reserved.15Captured Packet Content(dbus data)harco#show platform capture elam data DBUS data:SEQ_NUM 5=0 x15QOS 3=0QOS_TYPE 1=0TYPE 4=0 ETHERNETSTATUS_BPDU 1=0IPO 1=0

24、NO_ESTBLS 1=0RBH 3=b000CR 1=0TRUSTED 1=1NOTIFY_IL 1=0NOTIFY_NL 1=0DISABLE_NL 1=0DISABLE_IL 1=0DONT_FWD 1=0INDEX_DIRECT 1=0DONT_LEARN 1=0COND_LEARN 1=0BUNDLE_BYPASS 1=0QOS_TIC 1=0INBAND 1=0IGNORE_QOSO 1=0IGNORE_QOSI 1=0IGNORE_ACLO 1=0IGNORE_ACLI 1=0PORT_QOS 1=0CACHE_CNTRL 2=0 NORMALVLAN 12=1020SRC_FL

25、OOD 1=0SRC_INDEX 19=0 x201LEN 16=64FORMAT 2=0 IPMPLS_EXP 3=0 x0REC 1=0NO_STATS 1=0VPN_INDEX 10=0 x100PACKET_TYPE 3=0 ETHERNETL3_PROTOCOL 4=0 IPV4L3_PT 8=255MPLS_TTL 8=0SRC_XTAG 4=0 x0DEST_XTAG 4=0 x0FF 1=0MN 1=0RF 1=0SC 1=0CARD_TYPE 4=0 x0DMAC =0012.43b2.a1c0SMAC =0001.0000.0300IPVER 1=0 IPV4IP_DF 1

26、=0IP_MF 1=0IP_HDR_LEN 4=5IP_TOS 8=0 x0IP_LEN 16=46IP_HDR_VALID 1=1IP_CHKSUM_VALID 1=1IP_L4HDR_VALID 1=0IP_OFFSET 13=0IP_TTL 8=64IP_CHKSUM 16=0 xC3CCIP_SA =20.1.1.2IP_DA =160.1.1.1IP_DATA 1200000:00 01 02 03 04 05 06 07 08 09 0A 0B 0D 10 11 .CRC 16=0 xDB2A 2001,Cisco Systems,Inc.All rights reserved.1

27、6 2001,Cisco Systems,Inc.All rights reserved.16 2005,Cisco Systems,Inc.All rights reserved.16Capture Packet Contents(rbus data)RBUS data:SEQ_NUM 5=0 x15CCC 3=b100 L3_RWCAP1 1=0CAP2 1=0QOS 3=0EGRESS 1=0DT 1=1 GENERICTL 1=0 B32FLOOD 1=1DEST_INDEX 19=0 x3FDVLAN 12=1021RBH 3=b101RDT 1=0GENERIC 1=0EXTRA_

28、CICLE 1=0FABRIC_PRIO 1=0L2 1=0FCS1 8=0 x1DELTA_LEN 8=4REWRITE_INFO i0 -replace bytes from ofs 0 to ofs 13 with seq 00 0B 45 B6 36 40 00 12 43 B2 A1 C0 88 47.insert seq 00 01 21 3F before ofs 14.FCS2 8=0 xC2 2001,Cisco Systems,Inc.All rights reserved.17 2001,Cisco Systems,Inc.All rights reserved.17 2

29、005,Cisco Systems,Inc.All rights reserved.17Same Packet Captured on Ixia 2001,Cisco Systems,Inc.All rights reserved.18 2001,Cisco Systems,Inc.All rights reserved.18 2005,Cisco Systems,Inc.All rights reserved.18Some Trigger Setting SamplesFor packet from/to any mac addressFor IP packetsshsh platform

30、cap platform cap elamelam trigger trigger dbusdbus ipv4 if ipv4 if dmacdmac=0001.0002.0003=0001.0002.0003shsh platform cap platform cap elamelam trigger trigger dbusdbus ipv4 if ipv4 if smacsmac=0001.0002.0003=0001.0002.0003For non-IP(others)dest.MACshsh platform cap platform cap elamelam trigger tr

31、igger dbusdbus other if other if data=0 x00010002 0 x00030000 0 xffffffff 0 xffff0000data=0 x00010002 0 x00030000 0 xffffffff 0 xffff0000For non-IP(others)source.MACshsh platform cap platform cap elamelam trigger trigger dbusdbus if data=0 if data=0 0 x00000004 0 x00050006 0 0 x0000ffff 0 xffffffff0

32、 x00000004 0 x00050006 0 0 x0000ffff 0 xffffffff 2001,Cisco Systems,Inc.All rights reserved.19 2001,Cisco Systems,Inc.All rights reserved.19 2005,Cisco Systems,Inc.All rights reserved.19Some Trigger Setting Samples(Cont.)For packet from/to RP LTL Index of the RP is 0 x380,so in order to capture To R

33、Psh platform cap elam trigger rbus if dest_index=0 x380From RPsh platform cap elam trigger dbus ipv4 if src_index=0 x380For MPLS Packet Capturingsh platform capture elam trigger dbus others if data=0 0 0 0 x8847f1ba 0 xb0000000 0 0 0 0 xffffffff 0 xf0000000 This trigger captures any unicast MPLS pac

34、ket with outer label F1BAB 2001,Cisco Systems,Inc.All rights reserved.20 2001,Cisco Systems,Inc.All rights reserved.20 2005,Cisco Systems,Inc.All rights reserved.20References:CLI manualhttp:/sjc-fs1-web/wg-c/cnaik-group/Published/Generic%20Trouble-shooting%20Tips/ELAM_CLI.htmlTOI slideshttp:/sjc-fs1-web/wg-c/cnaik-group/Published/Generic%20Trouble-shooting%20Tips/C2-TOI-ELAM.pptELAM spechttp:/wwwin- based enhanced ELAM interfacehttp:/wwwin-