ASR9000 NP Packet Capture

References:
BRKSPG-2904 - ASR9000 Selected Topics and Troubleshooting (2016 Last Vegas)

As of IOS-XR 5.3.3 in Typhoon and Tomahawk linecards the NP can perform packet captures that do not interrupt service or drop packets. There is a circular buffer (32 packets on Typhoon cards and 128 packets on Tomahawk cards) that is used.

Parts of the stats memory on an NP has been carved out for per uIDB (Micro Interface Descriptor Block) stats (NPs see a physical interface, sub-interface, BE interface or BE sub-interface as an individual uIDB). One can view the uIDB for a specific port as below, which shows the features enabled in hardware as well as the interface index:

RP/0/RSP0/CPU0:abr1#show uidb data location 0/0/CPU0 Gi0/0/0/7.100 ingress | ex 0x0
--------------------------------------------------------------------------
  Location = 0/0/CPU0
  Index = 67
  INGRESS table
------------
  Layer 3
------------
  Status                           0x1
  Ifhandle                         0x4000dc0
  Index                            0x43
  Stats Pointer                    0x5306c4
  MPLS Enable                      0x1
  IPV4 Enable                      0x1
  IPV4 ICMP Punt                   0x1
  TCAM QOS ACL FORMAT              0x1
  Exact Option                     0x1
  Wire Exp Tag Num                 0x1
  IPV4 BFD Enable                  0x1
  ipv4 Racetrack Eligible          0x1
  mpls Racetrack Eligible          0x1

Packets can be captured that increment the NP counters during this period, any increments to the counters in this period do not show in the global counters output of "show controllers np counters ..." so they do not pollute the global counters.

RP/0/RSP0/CPU0:abr1#monitor np interface te0/0/0/0 time 2 location 0/0/CPU0
 Monitor NP counters of TenGigE0_0_0_0 for 2 sec


Monitor 3 non-zero NP0 counters:  TenGigE0_0_0_0
Offset  Counter                                         FrameValue   Rate (pps)
-------------------------------------------------------------------------------
 142 RSV_DROP_IPV4_RXADJ_DROP_MONITOR                      1667721           0
 262 RSV_DROP_MPLS_LEAF_NO_MATCH_MONITOR                         1           0
1278 PARSE_DROP_FAB_UNKNOWN_INJ_MONITOR                    1667721           0

There can only be one of these monitor sessions per LC at a time. Monitoring on a physical interface or a sub-interface monitors only on that single interface. Monitoring on BE sub-interface runs the monitor on all NPs that host member links. Works perfectly for input drops, not all output drops are captured though.

The meaning of drop counters can be viewed with "show controllers np descriptions location 0/0/CPU0".

The NPs are capturing packets in the circular buffers that match specific drop counters all the time, even when a specific manual check isn't being run. The command "show controllers np capture np0 help location 0/0/CPU0" shows which counters NPs are currently being capturing for. This can be changed using the "show controllers np capture np0 filter [all|drop_counter_name] [enable|disable] location 0/0/CPU0" command. The command "show controllers np capture np0 location 0/0/CPU0 detail" shows the contents of the circular packet buffer.

In the example below the NP has captured a packet that was dropped. It was a Spanning Tree frame received on VLAN 402 into sub-interface Gi0/0/0/9.402 which is a layer 3 interface so SPT is not running here:

RP/0/RSP0/CPU0:abr1#show controllers np capture np0 location 0/0/CPU0 detail | begin PARSE_L3_TAGGED_PUNT_DROP
PARSE_L3_TAGGED_PUNT_DROP
 From GigabitEthernet0_0_0_9: 72 byte packet on NP0
 Frame offset: 0
 hdr: 36 18 ad 5d 40 01 00 00 46 05 15 00 15 00 44 00

0000: 01 00 0c cc cc cd fc 5b 39 05 ed 01 81 00 e1 92
0010: 00 32 aa aa 03 00 00 0c 01 0b 00 00 00 00 00 81
0020: 92 50 67 ae 27 66 00 00 00 00 04 81 92 fc 5b 39
0030: 05 ed 00 80 01 01 00 14 00 02 00 0f 00 00 00 00
0040: 00 02 01 92


RP/0/RSP0/CPU0:abr1#show controllers np descriptions location 0/0/CPU0 | i PARSE_L3_TAGGED_PUNT_DROP
PARSE_L3_TAGGED_PUNT_DROP                            Drop L3       Dropped L2 link level protocol received at L3 interface with vlan tag (LLDP, MSTP, UDLD, CDP)


RP/0/RSP0/CPU0:abr1#show int desc | i 0/0/0/9
Gi0/0/0/9          up          up          xxxxxxxx
Gi0/0/0/9.5        up          up          xxxxxxx
Gi0/0/0/9.402      up          up          xxxxxx
Gi0/0/0/9.403      up          up          xxxxx
Gi0/0/0/9.405      up          up          xxxx
Gi0/0/0/9.2047     up          up          xxx

RP/0/RSP0/CPU0:abr1#show run int Gi0/0/0/9.402
interface GigabitEthernet0/0/0/9.402
 description xxxxxx
 vrf xxxxxx
 ipv4 address 10.127.255.9 255.255.255.248
 encapsulation dot1q 402

---