nexus 7k monitor sup inband interface on F2e line card and shim header

[fly]

• When the supervisor inband interface is monitored in the transmit direction on F2 Series modules, a 12-byte SHIM header is inserted after SMAC in SPAN packetI read document , config monitor on supvisor inband interface , if traffic pass through 
  F2/F2e linecard (transmit direction), SPAN will add a SHIM header
  I found I capture many ethertype 0xf001 packet in wireshark  ,wireshark label these packet as data 
  and these packets come from outside of nexus 7010 (means go into F2e line card interface) and I capute these packet on SUP Inband interface.

     my question is what means is "transmit direction" ,   F2e module send traffic to sup  or sup send traffic to F2e module via sup inband interface?

        I attatch a SPAN packet ,

       thank you

Tom

[Christopher Hart]

Hi Tom,

When you configure a SPAN monitor session and use the supervisor inband interface as a source interface, the RX/ingress direction signifies traffic received by the supervisor inband interface (meaning, control plane traffic sent from a line card to the supervisor). The TX/egress direction signifies traffic transmitted by the supervisor inband interface (meaning, control plane traffic sent from the supervisor to a line card).

In other words, the following configuration will replicate traffic received by the supervisor inband interface sent from a line card to the supervisor out of Ethernet1/1:

switch# configure terminal
switch(config)# monitor session 1
switch(config-monitor)# source interface sup-eth0 rx
switch(config-monitor)# destination interface Ethernet1/1
switch(config-monitor)# no shutdown
switch(config-monitor)# end
switch# 

The following configuration will replicate traffic transmitted by the supervisor inband interface sent from the supervisor to a line card out of Ethernet1/1:

switch# configure terminal
switch(config)# monitor session 1
switch(config-monitor)# source interface sup-eth0 tx
switch(config-monitor)# destination interface Ethernet1/1
switch(config-monitor)# no shutdown
switch(config-monitor)# end
switch# 

I hope this helps - thank you!

-Christopher

[fly]

Hi Christopher

    Thank you

     Sorry for the delay

     I found many ether type is 0xf001 packet i caputer on nexus 7000 contolane , I know this shim header  by cco expained.

     But How can I decode these 0xf001 packet hit control plane, I found many 0xf001 packet hit control plane I want to figure out what packet it is.

  please see attachment

    thank you

Tom

[Christopher Hart]

Hi Tom,

There's no supported way to "decode" the shim headers of these packets. If you want to view these packets in Wireshark as if they were normal packets, the easiest way to accomplish this would be to edit the PCAP file such that 12 bytes are stripped from each packet starting with byte #13 and ending with byte #24. This can be done with the editcap utility like shown below:

$ editcap -C 12:12 capture_with_shim_headers.pcap capture_without_shim_headers.pcap

This command runs the editcap utility with the -C, or "chop" flag. The first "12" between the colon is the offset (in bytes) within each packet that you would like to chop, and the second "12" after the colon is the number of bytes you want to remove from each packet. The first filepath (in my example, "capture_with_shim_headers.pcap") is the PCAP file you've created on your capture machine through your SPAN session, while the second filepath (in my example, "capture without_shim_headers.pcap") is the PCAP file you would like to create with the shim headers removed.

I hope this helps - thank you!

-Christopher