cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
368
Views
0
Helpful
2
Replies

Wireshark - output

Ratheesh mv
Beginner
Beginner

My CE router is sending plenty of subnets to PE. I have captured .pcap file of BGP update and I would like to see one of specific NLRI information form the pcap file. When I have opened the pcap file there are plenty of NLRI info .How can I filter for specific subnet .

Example :- From the plenty of subnets I would like to see only 192.168.10.0/24 and their attributes .Is it possible if yes how ?

Thanks in advance

2 Replies 2

Giuseppe Larosa
Hall of Fame Master Hall of Fame Master
Hall of Fame Master

Hello @Ratheesh mv ,

>> From the plenty of subnets I would like to see only 192.168.10.0/24 and their attributes .Is it possible if yes how ?

 

For efficiency reasons BGP updates are structured in such a way that all NLRIs sharing the same attributes are sent after the set of common attributes.

For this reason if you manage the PE node you can get info about a specific prefix on it

show ip bgp vrf <VRF-name> 192.168.10.0

 

From the raw packet capture this is not so easy for the reasons explained above. The BGP update can become too big to fit in a single packet and so it is carried in multiple IP packets and only the first packet contains the list of BGP attributes shared by many prefixes.

 

Hope to help

Giuseppe

 

MHM Cisco World
VIP Mentor VIP Mentor
VIP Mentor

If this is LAB then 
remove the prefix  
do wireshark 
you will see withdraw, 
you can check this withdraw see if contain the attribute you need to see.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers