Cable Monitor Feature configuration and lab setup.
UBR10K2 Free Ethernet Port on UBR10K (Optional) Catalyst Switch
For a detailed overview of this feature refer to the Cisco CMTS feature guide on Cable Monitor. This guide is intended for lab use specific to SJC-TAC Lab.
Cable monitor is similar to the SPAN feature found on Catalyst switches. It allows the user to capture traffic both going to and from a particular device off of the RF Plant. The Cable Monitor feature allows the granularity to peek at the DOCSIS layer packets such as UCD, SYNC, and MAPS. Depending on your configuration, you can have the CMTS duplicate all traffic to and from a particular SID, MAC, or Host and span it out a FastEthernet Port.
Preparing the Cabling:
Often in our lab the topology is a limitation. Often we will have a free fiber GigE Port off of the ESR-1GE on the UBR10K but no RJ-45 Copper FastE or GigE ports as required by our PCs. Often we utilize a Catalyst switch to do the conversation between fiber and copper. Should you have the matching media from the UBR10K to your Sniffer, then you can skip this section:
1. Hook up your Fiber to the fiber GigE port on the catalyst switch
2. Verify that the GigE port and the Ethernet port you decide to use are on the same VLAN
3. Issue the following commands to SPAN the port off the Catalyst switch.
In the above example your UBR10K is using Fiber to the Gig0/1 Port and your PC is off the of Fast0/17. Anything to and from Gig0/1 will be duplicated to Fa0/17.
To enable cable monitor, you will need to locate the cable modem you wish to monitor. Cable monitor can identify the trace by the cable modem SID, MAC address, or against an ACL.
For SID of a particular Cable Modem, you can use the “show cable modem” command to locate the SID and then issue this under the interface:
UBR10K2-Main#scm MAC Address IP Address I/F MAC State Prim RxPwr Timing Num BPI Sid (dBmV) Offset CPE Enb … 0020.4094.52bc 10.0.0.6 C7/0/0/U0 reject(c) 205 0.50 1870 0 N 0018.19b6.2baa 10.0.0.3 C7/0/0/U0 online(pt) 206 0.75 1020 1 Y …
Then configure the CMTS to track by this SID under the interface configuration with the cable monitor command. For example, you want to monitor all traffic to and from the CM with SID 205 and you want to send that duplicated traffic our your free Gig3/0/0 port. You also want DOCSIS level of granularity (as opposed to regular 802.3 frames):
router(config-if)#cable monitor interface gig3/0/0 sid 205 packet-type data docsis
If you want the CMTS to decapsulate the DOCSIS framing and use the regular 802.3 Ethernet II frame:
router(config-if)#cable monitor interface gig3/0/0 sid 205 packet-type data Ethernet
Alternatively, you can choose to target the CM by its MAC-Address:
router(config-if)#cable monitor interface gig3/0/0 mac-address 0020.4094.52bc packet-type data Ethernet
Lastly, you can choose to target the CM by an ACL:
router(config-if)#cable monitor interface gig3/0/0 access-list 1 packet-type data ethernet
Preparing Wireshark for DOCSIS Frames:
If you choose “packet-type data docsis” under the interface configuration command, then the result will be DOCSIS encapsulated frames. Wireshark and ethereal will not, by default, understand these frames and you will see many TCP Segmentation and Bad TCP packets.
To tell Wireshark to interpret the frames as DOCSIS frames: