Solved: Help with packet capture on an MXP system running F9.3.3

juriss · ‎10-29-2014

Does anyone have a good set of instructions on how to do a full packet capture on an MXP endpoint.

I would love to do something that I can open directly in Wireshark.

We are looking to verify that the DSCP markings are being sent and received on the UDP traffic that is being sent and received from an MXP.

I have all the DSCP settings in the MXP configured,,, but I want to verify that the markings are surviving end to end.

Does it require Root access?

Can I see that in a log file rather than a full packet capture?

We use the packet capture in the TC7.1 on a regular bases and is works great... wish they would add that to the MXP web interface

Thanks

Martin Koch · ‎10-29-2014

There is no way to handle that direly on an MXP endpoint.

So you would need a switch which supports a monitor mode (ok you have to

trust the switch to show what you want to see) or some other capturing

device which you can inject in the path.

Good success.

If this post was helpful please rate this post with the stars below!

Please remember to rate helpful responses and identify

View solution in original post

Martin Koch · ‎10-29-2014

There is no way to handle that direly on an MXP endpoint.

So you would need a switch which supports a monitor mode (ok you have to

trust the switch to show what you want to see) or some other capturing

device which you can inject in the path.

Good success.

If this post was helpful please rate this post with the stars below!

Please remember to rate helpful responses and identify

Jens Didriksen · ‎10-29-2014

Been trying to work out how to do this on SX/C-series running TC7.2.x where there's no root access. Would it work with the "Remote Support User" account - or is it something I've missed in the admin account?

/jens

Please rate replies and mark question(s) as "answered" if applicable.

Wayne DeNardi · ‎10-29-2014

Hi Jens,

On a SX/C running recent firmware, in the Web Interface, go to Diagnostics / Log Files.

From there you "Start Extended Logging" to generate a packet capture.

But, if you really want to use the "remotesupport" account, you can do a tcpdump from the shell in a similar way you used to as "root".

Wayne
--
Please remember to rate respoinses and to mark your question as answered if appropriate.

Wayne
--
Please remember to mark helpful responses and to set your question as answered if appropriate.

Jens Didriksen · ‎10-29-2014

Thanks Wayne, never occurred to me to do this from the web gui, doesn't seem right somehow. ;)

/jens

Please rate replies and mark question(s) as "answered" if applicable.

Wayne DeNardi · ‎10-29-2014

Nope, but they're pushing more and more things that way and less and less is available from the command line.

Makes it nice and easy to grab a quick capture - but doesn't allow filtering at the point of capture as the old way did.

Wayne
--
Please remember to rate responses and to mark your question as answered if appropriate.

Wayne
--
Please remember to mark helpful responses and to set your question as answered if appropriate.