Date created: 11/11/21 08:21:26. Last modified: 11/11/21 09:44:18

NCS540 Packet Capture

 

Packet Capture to Disk

Tested with XR 7.1.2. The monitor-session name must start with a number like "mirror-session 1", seems there is a bug, very reliably, no packets are captured! Use an alphabetical name instead.

! Create the capture profile
monitor-session JB ethernet
destination file size 1024 buffer-type linear

! Then apply it to an interface...
! A "normal" (meaning non-bundle) interface can be applied as followed:
interface Te0/0/0/24
monitor-session JB direction rx-only port-level

! If the interface is part of a bundle, the monitor session must be applied to the bundle inteface.
! Applying to bundle member interface is not supported
!
interface be1
monitor-session JB ethernet direction rx-only port-level

! Commit the config then run the capture
commit
end

RP/0/RP0/CPU0:ma0#show monitor-session JB status detail
Monitor-session JB
Destination File - Not collecting
Source Interfaces
-----------------
Bundle-Ether1
Direction: Rx-only
Port level: True
ACL match: Disabled
Portion: Full packet
Interval: Mirror all packets
Status: Operational

RP/0/RP0/CPU0:ma0#monitor-session JB packet-collection start

RP/0/RP0/CPU0:ma0#show monitor-session JB status detail
Monitor-session JB
Destination File - Packet collecting
Source Interfaces
-----------------
Bundle-Ether1
Direction: Rx-only
Port level: True
ACL match: Disabled
Portion: Full packet
Interval: Mirror all packets
Status: Operational

RP/0/RP0/CPU0:ma0#monitor-session JB packet-collection stop write directory /misc/disk1 filename jb

RP/0/RP0/CPU0:ma0#LC/0/0/CPU0: spp[117]: %PKT_INFRA-spp-6-SPAN_FILE_WRITE_SUCCESSFUL : SPAN write to file (Filename: /disk0:/span_node0_0_CPU0/node0_0_CPU0/jb.pcap) successful for node node0_0_CPU0

RP/0/RP0/CPU0:ma0#dir harddisk:/node0_0_CPU0/jb.pcap

Directory of harddisk:/node0_0_CPU0/jb.pcap
1175043 -rw-r--r--. 1 1023848 Nov 11 09:21 node0_0_CPU0/jb.pcap

23893884 kbytes total (21136432 kbytes free)

$scp me@ma0:/harddisk:/node0_0_CPU0/jb.pcap ./

Previous page: NCS540 Overview
Next page: NCS540 Troubleshooting