07-20-2021 02:20 AM
When the supervisor inband interface is monitored in the transmit direction on F2 Series modules, a 12-byte SHIM header is inserted after SMAC in SPAN packetI read document , config monitor on supvisor inband interface , if traffic pass through
F2/F2e linecard (transmit direction), SPAN will add a SHIM header
I found I capture many ethertype 0xf001 packet in wireshark ,wireshark label these packet as data
and these packets come from outside of nexus 7010 (means go into F2e line card interface) and I capute these packet on SUP Inband interface.
my question is what means is "transmit direction" , F2e module send traffic to sup or sup send traffic to F2e module via sup inband interface?
I attatch a SPAN packet ,
thank you
Tom
07-28-2021 05:53 AM
Hi Tom,
When you configure a SPAN monitor session and use the supervisor inband interface as a source interface, the RX/ingress direction signifies traffic received by the supervisor inband interface (meaning, control plane traffic sent from a line card to the supervisor). The TX/egress direction signifies traffic transmitted by the supervisor inband interface (meaning, control plane traffic sent from the supervisor to a line card).
In other words, the following configuration will replicate traffic received by the supervisor inband interface sent from a line card to the supervisor out of Ethernet1/1:
switch# configure terminal
switch(config)# monitor session 1
switch(config-monitor)# source interface sup-eth0 rx
switch(config-monitor)# destination interface Ethernet1/1
switch(config-monitor)# no shutdown
switch(config-monitor)# end
switch#
The following configuration will replicate traffic transmitted by the supervisor inband interface sent from the supervisor to a line card out of Ethernet1/1:
switch# configure terminal
switch(config)# monitor session 1
switch(config-monitor)# source interface sup-eth0 tx
switch(config-monitor)# destination interface Ethernet1/1
switch(config-monitor)# no shutdown
switch(config-monitor)# end
switch#
I hope this helps - thank you!
-Christopher
01-04-2022 12:32 AM
Hi Christopher
Thank you
Sorry for the delay
I found many ether type is 0xf001 packet i caputer on nexus 7000 contolane , I know this shim header by cco expained.
But How can I decode these 0xf001 packet hit control plane, I found many 0xf001 packet hit control plane I want to figure out what packet it is.
please see attachment
thank you
Tom
01-04-2022 07:06 AM
Hi Tom,
There's no supported way to "decode" the shim headers of these packets. If you want to view these packets in Wireshark as if they were normal packets, the easiest way to accomplish this would be to edit the PCAP file such that 12 bytes are stripped from each packet starting with byte #13 and ending with byte #24. This can be done with the editcap utility like shown below:
$ editcap -C 12:12 capture_with_shim_headers.pcap capture_without_shim_headers.pcap
This command runs the editcap utility with the -C, or "chop" flag. The first "12" between the colon is the offset (in bytes) within each packet that you would like to chop, and the second "12" after the colon is the number of bytes you want to remove from each packet. The first filepath (in my example, "capture_with_shim_headers.pcap") is the PCAP file you've created on your capture machine through your SPAN session, while the second filepath (in my example, "capture without_shim_headers.pcap") is the PCAP file you would like to create with the shim headers removed.
I hope this helps - thank you!
-Christopher
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide