NCS540 Packet Capture

 

Packet Capture to Disk

Tested with XR 7.1.2. The monitor-session name must not start with a number like "monitor-session 1", seems there is a bug, very reliably, no packets are captured! Use an alphabetical name instead.

! Create the capture profile
monitor-session JB ethernet
 destination file size 1024 buffer-type linear

! Then apply it to an interface...
! A "normal" (meaning non-bundle) interface can be applied as followed:
interface Te0/0/0/24
 monitor-session JB direction rx-only port-level

! If the interface is part of a bundle, the monitor session must be applied to the bundle inteface.
! Applying to bundle member interface is not supported
!
interface be1
 monitor-session JB ethernet direction rx-only port-level

! Commit the config then run the capture
commit
end

RP/0/RP0/CPU0:ma0#show monitor-session JB status detail
Monitor-session JB
  Destination File - Not collecting
  Source Interfaces
  -----------------
  Bundle-Ether1
    Direction:  Rx-only
    Port level: True
    ACL match:  Disabled
    Portion:    Full packet
    Interval:   Mirror all packets
    Status:     Operational

RP/0/RP0/CPU0:ma0#monitor-session JB packet-collection start

RP/0/RP0/CPU0:ma0#show monitor-session JB status detail
Monitor-session JB
  Destination File - Packet collecting
  Source Interfaces
  -----------------
  Bundle-Ether1
    Direction:  Rx-only
    Port level: True
    ACL match:  Disabled
    Portion:    Full packet
    Interval:   Mirror all packets
    Status:     Operational

RP/0/RP0/CPU0:ma0#monitor-session JB packet-collection stop write directory /misc/disk1 filename jb

RP/0/RP0/CPU0:ma0#LC/0/0/CPU0: spp[117]: %PKT_INFRA-spp-6-SPAN_FILE_WRITE_SUCCESSFUL : SPAN write to file (Filename: /disk0:/span_node0_0_CPU0/node0_0_CPU0/jb.pcap) successful for node node0_0_CPU0

RP/0/RP0/CPU0:ma0#dir harddisk:/node0_0_CPU0/jb.pcap

Directory of harddisk:/node0_0_CPU0/jb.pcap
1175043 -rw-r--r--. 1 1023848 Nov 11 09:21 node0_0_CPU0/jb.pcap

23893884 kbytes total (21136432 kbytes free)

$scp me@ma0:/harddisk:/node0_0_CPU0/jb.pcap ./

---