cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
215
Views
0
Helpful
1
Replies

Onboard Packet Capture SDA

Dominik_
Beginner
Beginner

Hi SDA-Experts, 

 

shortly to the environement: 

 

we have an SDA Fabric in our Location. 

 

We use the Catalyst C9300-48P as Access Switch. 

Our actual version is the 17.3.4 (which was the recommended at this time) 

 

Now we recently had a case on our end where we wanted to capture multicast traffic for one of the attached devices. 

Since it is a quite remote location we wanted to use the onboard capture of the C9300. 


So we added the Trace like this: 

monitor capture [CapName] file ring 3 size 100 location flash:[CAPNAME].pcap interface [,...] both match any

 

But from the capture itself I only see incoming traffic. So from the device to the switch.  Everything which is 

VXLAN encapsulated to the device is not visible here. We did a workaround to capture the Uplink and decoded VXLAN in the capture. But for switches with high traffic beside the one we want to capture this is not feasible since we get a big load of data that we don't need... 

 

Anybody has some tip how to get all the traffic? Or is the only way to do a span session? 

 

 

1 Reply 1

Flavio Miranda
Advisor
Advisor

Hi

 The behavior you are seing seems to be expected. As you are using "Embedded Packet Capture", Cisco informs that:

"EPC captures multicast packets only on ingress and does not capture the replicated packets on egress."

 

What you can try is to use "Wireshark" mode on the switch. Ultimately, you can try to run Wireshark on the endpoint, if possible.

 

You can refer to this guide for more information:

 

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/16-9/configuration_guide/nmgmt/b_169_nmgmt_9300_cg/configuring_packet_capture.html 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: