Packet Capture with Cisco ACI

[Thiyagarajan K]

Hello All,

I'm troubleshooting application issue and would like to know whether the request from client is reaching the APIC for that I'm trying to use tcpdump utility on ACI.

Can you help us to know the tcpdump syntax to capture traffic over inband interface or outofband interface with IP address 10.10.10.10?

Regards,

Thiyagu

[Tomas de Leon]

Application issue?  What type of application are you sending to the APIC? SDK or API?

Applications typically go thru the leaf and spines not the APIC. In regards to "tcpdump" on the APIC, it requires "root" access.  You would need to open a Cisco TAC Case and a Customer Support Engineer can assist you in troubleshooting the issue.

Thanks for using the Customer Support Community for ACI!

Cheers!

T.

[Thiyagarajan K]

Thanks a lot Tomas. Could you please help me to know the tcpdump syntax to capture traffic on Leaf switches?

Regards,

Thiyagu

[Tomas de Leon]

Thiyagu,

It is hard to answer your question correctly with the limited amount of information provided. 

For example, if you wanted to capture a trace for SNMP Traps from a "management" interface, you could use:

tcpdump -i eth0 -f port 162 -vv

But if you are looking to look at some things in the fabric you need to look at using span or elam.

http://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/troubleshooting/b_APIC_Troubleshooting/b_APIC_Troubleshooting_chapter_01.html#d19876e1919a1635

Also Take a look at:
http://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/troubleshooting/b_APIC_Troubleshooting/troubleshooting_wizard.html

If we had more specifics on your intent or what you are capturing, we may be able to provide additional information.

You can also open an Cisco TAC with more details of issue and they can assist you with your questions.

Cheers!

T.

[Thiyagarajan K]

Apperciate your help Tomas. 

Could you please help me to know  the tcpdump command syntax to capture the ingress traffic on mgmt interface on leaf or on APIC?

Regards,

Thiyagu

[Tomas de Leon]

I gave you an example of tcpdump syntax in my previous reply.

For example, if you wanted to capture a trace for SNMP Traps from a "management" interface, you could use:

tcpdump -i eth0 -f port 162 -vv

For the leaf, you simply need to change the ports to what you want to look for. you can also look at:

http://www.tcpdump.org/tcpdump_man.html

You cannot run tcpdump as "admin" user on the APIC.