Span Capture on ACE Back-Plane

[Martin Charles]

Hi Experts!

I am facing an issue while trying to capture a Span traffic on ACE  Tengig Interface .. Not sure what i am missing as  all the required configs seems to right...

My ACE box is @ Slot 7

Router(config)#monitor session 1 source interface TenGigabitEthernet 7/1 both
Router(config)#monitor session 1 destination interface GigabitEthernet 2/14
Router(config)#monitor session 1 filter vlan 100,200

I am redirecting the traffic to Gigabitethernet 2/14 which is a Linux machine (eth1) port. , Please find the configuration below...

Router(config)#interface GigabitEthernet 2/14
Router(config-if)#switchport
Router(config-if)#switchport trunk encapsulation dot1q
Router(config-if)#switchport mode trunk
Router(config-if)#switchport nonegotiate

But i am unable to see any traffic on the Linux machine when i do  tcpdump -i eth1  .For basic troubleshooting i removed all sub-interface vlan configured in the PC and it just has eth0 (mgmt) & eth1  ... I have also confirmed that the eth1 is connected on GigabitEthernet 2/14 

of CAT6k .. Also removed the vlan filter , but the result same , No Captures seen on the PC !!

I have tried basic ping from ACE to my rserver , Since this needs to go through CAT6k , i don't see it on captures..

Anything else i am missing here!! Please help!!

Thanks

Martin

[Kanwaljeet Singh]

Hi Martin,

The configuration for SPAN on 6500 is perfectly fine. Not sure about TCP dump on linux. Did you try with a PC running wireshark and see if it captures any traffic?  Did you try and send any other traffic than ICMP?Any traffic to and fro should be captured on this. There is no problem with configuration.

Regards,

Kanwal

[Santhosh S]

Do the interface counters (switch and host) show any traffic traversing through them?

Could it be the NIC drivers not supporting?

Here is a link on how to configure NICs using some of the Intel chipsets to pass the VLAN tagging info:

http://support.intel.com/support/network/sb/CS-005897.htm

Wireshark has posted this info, as well as how to configure NICs with the Broadcom chipset:

http://wiki.wireshark.org/CaptureSetup/VLAN#head-e0dc0f9fe0cc6b1b1866d78da7b97ead34dca1d8

HTH,

Santhosh

[Martin Charles]

Hey Guys ... Thanks for your time.. I do get the captures now.. But its taking a huge time i.e after 15 to 20 min after the actual traffic passes thro the ACE .... Not sure of the reason  , I even tried reloading the box , Which now helps a bit..

However i am seeing vlan tag on the captures .. Is it my NIC adapter removes the tag while we do span capturing ????

@ Santhosh .. Thanks for the link , i hope by default the linux NIC wok in promiscuous mode , but not sure why i am seeing the vlan tags after the capture....

Let me know if we need to enable specific command in the linux box or any config changes on the port configuration on CAT6k .. I have made as trunk with encap dot1q ..

Again thanks  for your time...

Regards

Martin

[Santhosh S]

I do get the captures now.. But its taking a huge time i.e after 15 to 20 min after the actual traffic passes thro the ACE .... Not sure of the reason  , I even tried reloading the box , Which now helps a bit.. 

That is definitely unusual.

Would you be able to install wireshark on that machine and check if it can sniff the traffic? I'm not too familiar with *nux so I cannot be of much help there.

Could you try without the VLAN filter command just to test?

The switch configuration looks good, you would not need any additional commands on the switch.

[Martin Charles]

Hi Santhosh..

   Yes the wireshark works. But it takes some time at the intial stage as similar to tcpdump ... But it works now.....

   But i dont see my vlan tag .. Is it something  with the limitation on the Linux NIC ? which removes the vlan tag?

Thanks

Martin

[Kanwaljeet Singh]

Hi Martin,

It could very well be.  Santhosh has pasted above two links which you can refer for configuring NIC's for intel chipsets. Not sure which chipset linux machine has or if there is any other setting. May be a quick search in Linux forums throw up something.

Regards,

Kanwal