Nexus 9000 Ethanalyzer behavior - missing packets

[sjhwilkes]

I have two top of rack N9Ks, in addition to ToR layer 2 duty these are BGP peering with NSX-T, each with a single Edge. Trying to troubleshoot a BGP flapping issue and captures at the NSX end are showing unanswered ARP requests.

ethanalyzer local interface inband capture-filter "host 192.168.100.105" limit-captured-frames 100

On one ToR this works exactly as expected and I see BGP keepalives, BFD etc. all looks well. On the other it fails to see the locally destined traffic - despite BGP / BFD connections being up, for some reason ethanalyzer doesn't see the frames. Same exact config except the IP addresses, same NX-OS version...so I'm stumped - anyone know the internal workings of Ethanalyzer and why these two switches could be behaving differently?

[Sergiu.Daniluk · Accepted solution]

Have you tried using "display-filter ip.addr==192.168.100.105" instead of the capture-filter?

Cheers,

Sergiu

[sjhwilkes]

Thanks, I get to see what I needed.  Don't understand why display works while capture doesn't but anyhow...

[Darian O'Dirling - TCE]

Hi @sjhwilkes ,

I see you are interested in learning more about Ethanalyzer. I encourage anyone wants to learn more about Ethanalyzer to watch this video made by a colleague mind. This is a video walk-through of how to use the Ethanalyzer capture tool on Nexus series switches.

https://www.youtube.com/watch?v=1toLt9G_V1Q