MPLS L2VPN packet capture

[jerry.z.fan]

Hi,

I want to capture packet on gi0/0 of PE1 in order to show customer that all his traffic is encapsulated and transmitted by L2VPN (ldp signaling) in his lab.

CE1-----------(g0/1)PE1(g0/0)------------PE2-----------CE2

PE1 and PE2 are Cisco3945 and L2VPN is working well. I tried cisco RITE(Router IP Traffic Export Packet Capture) feature, but the output was not what I expected. I tried both export mode and capture mode. Only LDP hello message I got, looks like RITE is only interested in IP packet. Monitor session wasn't effective as well because it is not a switch.

Is there any other way/workaround to capture customer's traffic encapsulated in L2VPN?

---------------------------------------------------------------

What I did on PE1 when I was trying RITE export mode:

ip traffic-export profile test

bidirectional

interface GigabitEthernet0/2

mac-address e411.5b44.3a6d

interface GigabitEthernet0/2

ip address 10.1.2.1 255.255.255.0

interface GigabitEthernet0/0

ip traffic-export apply test

Gi0/2 connected my PC(10.1.2.2) with wireshark installed.

---------------------------------------------------------------

Many thanks.

Regards,

Jerry Fan

[shivjain]

Hi

Can you try with "monitor capture" commmand. I think this support MPLS packets too.

regards

shivlu jain

www.mplsvpn.info

[shivjain]

Hi

Please check page number 35 in the below mentioned link

http://www.cisco.com/en/US/docs/ios-xml/ios/epc/command/epc-cr-book.pdf

regards

shivlu jain

[jerry.z.fan]

Thanks Shivlu. I tried, but failed. 'monitor capture' is only interested in ipv4 and ipv6. Maybe the IOS in Cisco3945 isn't same as the IOS in Cat6500 or Cisco7600 or GSR/CSR.

See following:

===================================================================

Router_MPS_TEST_A#monitor capture ?    

  buffer  Control Capture Buffers

  point   Control Capture Points

Router_MPS_TEST_A#monitor capture po

Router_MPS_TEST_A#monitor capture point ?

  associate     Associate capture point with capture buffer

  disassociate  Dis-associate capture point from capture buffer

  ip            IPv4

  ipv6          IPv6

  start         Enable Capture Point

  stop          Disable Capture Point

Router_MPS_TEST_A#monitor capture point ip ?

  cef               IPv4 CEF

  process-switched  Process switched packets

Router_MPS_TEST_A#monitor capture point ip p

Router_MPS_TEST_A#monitor capture point ip process-switched ?

  WORD  Name of the Capture Point

Router_MPS_TEST_A#monitor capture point ip process-switched test-point ?

  both     Inbound and outbound and packets

  from-us  Packets originating locally

  in       Inbound packets

  out      Outbound packets

Router_MPS_TEST_A#monitor capture point ip process-switched test-point b

Router_MPS_TEST_A#monitor capture point ip process-switched test-point both ?

Router_MPS_TEST_A#monitor capture point ip process-switched test-point both

===================================================================

At last, I have to insert a switch in the middle of two cisco3945 and configured port span. That worked very well. Anyway, many thanks for your advice.

Jerry Fan

[Miroslav Berkov]

Use WireShark for packet capture in future