Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

NAM CAPTURE is SIZE TRUNCATED with RSPAN

The packet capture is truncated by 4 bytes in each packet in the following situation:

6500 Switches with router/NAM

6500 #1 does RSPAN out on VLAN 600 for desired traffic to capture.

6500 #2 does RSPAN in on VLAN 600. (This is over an 802.1a VLAN Trunk).

#2 has the following commands to allow for complex pre-filtering of Capture Traffic:

analysis module 6 data-port 1 capture allowed-vlan 600

vlan access-map map-fwsm 100

match ip address acl-fwsm

action forward capture

!

vlan filter map-fwsm vlan-list 600

Access list "acl-fwsm" then allows for complex filtering criterea before the NAM receives the data to be captured.

The use of an 802.1q trunk inserts 4 bytes of VLAN info between the Ethernet header and the IP header.

This causes the trace data size to be off by 4 bytes and the following message is displayed by NAM decode:

Packet Length xx bytes, Capture bytes yy

on each packet

where yy is 4 less than xx.

Exporting the trace (or viewing it for that matter) results in the last 4 bytes of the packet to be missing.

Versions:

Cisco Network Analysis Module (WS-SVC-NAM-2) 3.1(1a)

IOS (tm) c6sup2_rp Software (c6sup2_rp-JS-M), Version 12.1(22)E1

Any suggestions for solution to getting the whole trace?

205
Views
0
Helpful
0
Replies