cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
564
Views
0
Helpful
1
Replies

monitor-session and URPF on CRS-1 IOS-XR platform

fly
Level 2
Level 2
If we running urpf under one interface and config this interface as source interface in one monitor session does traffic get sniffer to wireshark wheather traffic hit URPF or not?
1 Reply 1

Giuseppe Larosa
Hall of Fame
Hall of Fame

Hello fly,

it depends on the order of operations performed inside the router possible cases are the following:

a) if port mirroring happens before uRPF action you should get all packets arriving at the source interface either matching uRPF either failing uRPF check

b) if port mirroring happens after uRPF action you should get in packet capture only packets that pass uRPF check

 

c) if the two features are not compatible you may get no  packets on the wireshark protocol analyzer.

 

What do you see on the sniffer ?

 

Hope to help

Giuseppe

 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card