Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Colby Beam
Stats
Member since
07-01-2011
57
Posts
56
Helpful
5
Solutions
12-11-2013
12:54 PM
Kevin The biggest difference between thse three things (trunking, etherchanneling, port-channeling) is we only support Dot1Q now on the 3850 vs the 3750. ISL is gone. This is across all version for 3850, not specific to 3.3.0. I would also check out Luke's post above about QoS on the 3850 vs 3750 as we moved from MLS QoS to MQC QoS. This is a major change. I would check out the "what's new" for 3.3.0 to get the newest feature as we did add some significant features improvements http://www.cisco.com/en/US/docs/switches/lan/catalyst3850/software/release/3se/release_notes/OL_30562_01.html#wp342813 Below is the config guide for NetFlow. I started you off at the restrictions as we support flexible netflow on the 3850. http://www.cisco.com/en/US/docs/switches/lan/catalyst3850/software/release/3se/flexible_netflow/configuration_guide/b_fnf_3se_3850_cg_chapter_010.html#reference_C63398C01C7C41E1AEC2BCEE4915A909
... View more
12-10-2013
09:46 AM
Kevin The mgmt interface is in its own VRF and would be treated as a "host" interface. You cannot put it in a different VRF. The only configuration is an IP address interface GigabitEthernet0/0 vrf forwarding Mgmt-vrf ip address X.X.X.X X.X.X.X no ip route-cache negotiation auto end You would also need to create a default route for this VRF. Example: ip route vrf Mgmt-vrf 0.0.0.0 0.0.0.0 Y.Y.Y.Y If you wish to use this interface for copying TO the switch, you would need to configure the following. This will tell the switch to use this interface ip ftp source-interface GigabitEthernet0/0 ip tftp source-interface GigabitEthernet0/0 The upstream device that this Gi0/0 is plugged into just needs to be configured as a switchport access vlan. Typically customers put this in their mgmt vlan that they have configured in their network to access their devices via ssh/telnet. Let me know if you have further questions.
... View more
12-10-2013
09:40 AM
All of the switches in the stack have to have the same license level Q. What are the license requirements for a Cisco Catalyst 3850 switch stack? A. In a Cisco Catalyst 3850 stack, all switches should be at the same image-based license (IP Services/IPBase/LAN Base) level. The active switch license level is considered as the reference, and the member switch licenses are compared against it. If there is a mismatch, the active switch with the syslog message "license mismatch error" indicates that the stacking was unsuccessful. http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps12686/qa_c67-722110.html
... View more
12-09-2013
02:56 PM
Kevin All this means is that we changed the syntax some. It will still work, but eventually will be removed in later versions. I just tested this in the lab and got the same thing. It will also tell you the new syntax. Cisco IOS Software, IOS-XE Software, Catalyst L3 Switch Software (CAT3K_CAA-UNIVERSALK9-M), Version 03.03.00SE RELEASE SOFTWARE (fc1) 3850(config)#tacacs-server host 1.1.1.1 Warning: The cli will be deprecated soon 'tacacs-server host 1.1.1.1' Please move to 'tacacs server ' CLI Therefore in the future we will be using tacacs sever intead of of tacacs-server host. This is usually to fall into line with other platforms to make it easier to configure when moving between platforms for platform independent features, such as tacacs.
... View more
12-09-2013
02:44 PM
Kevin Could paste what configure you were attempting and what version you're running on the 3850? Thanks!
... View more
12-02-2013
04:17 PM
Stephen Excellent question. There is no exact documentation for the topology you are describing, however here is a quick example. interface Port-channel15 switchport mode trunk interface TenGigabitEthernet1/1/3 switchport mode trunk channel-group 15 mode active interface T enGigabitEthernet2/1/3 switchport mode trunk channel-group 15 mode active The configuration on the 6500 VSS would be almost identical excepf for the added encapsulation commands. The 3850 only supports Dot1Q, so there is no need to specify which encapsulation method on the 3850. interface Port-channel15 switchport switchport trunk encapsulation dot1q interface TenGigabitEthernet1/2/2 switchport switchport trunk encapsulation dot1q switchport mode trunk interface TenGigabitEthernet2/2/2 switchport switchport trunk encapsulation dot1q switchport mode trunk This would give you two uplinks across a stack of 3850s, and also across the switches in the 6500 VSS creating a MEC ( Multichassis EtherChannel). You could added extra links as needed or required. Let me know if there are further questions on this. The only addition configuration I can see is restricting which vlans you want on these links. I was able to find some documentation on best practices for 6500 VSS. http://www.cisco.com/en/US/products/ps9336/products_tech_note09186a0080a7c837.shtml
... View more
11-10-2013
11:55 PM
Protective Boot on Certain Network Cables Might Push the Mode Button and Cause an Unexpected Reset http://www.cisco.com/en/US/ts/fn/636/fn63697.html
... View more
Labels:
11-10-2013
11:50 PM
Hi Samuel, Looking into this quickly, could you try 3.2.3 or higher? I want to make sure we are not running into some instance of https://tools.cisco.com/bugsearch/bug/CSCud49264. If however after an upgrade, this does not resolve it, it appears this is then hardware faliure as we are having I/O errors when reading memory.
... View more
11-10-2013
11:45 PM
Hi Jason What version of code are you running on the 3850. I would check to make sure you are running 3.2.3 or 3.3.0 to get around https://tools.cisco.com/bugsearch/bug/CSCug87540
... View more
11-10-2013
10:56 PM
I am looking to test a normal 2960, to see if there is any difference. This may take a day or two.
... View more
11-10-2013
10:54 PM
Aurelien I just tested this on a 2960-S running SE5 with no issues. 2960-1#debug ip dhcp snooping packet DHCP Snooping Packet debugging is on 2960-1# Mar 30 01:30:23.963: DHCPSNOOP(hlfm_set_if_input): Setting if_input to Po1 for pak. Was Vl1 Mar 30 01:30:23.963: DHCPSNOOP(hlfm_set_if_input): Setting if_input to Vl1 for pak. Was Po1 Mar 30 01:30:23.963: DHCPSNOOP(hlfm_set_if_input): Setting if_input to Po1 for pak. Was Vl1 Mar 30 01:30:23.963: DHCP_SNOOPING: received new DHCP packet from input interface (Port-channel1) 2960-1# Mar 30 01:30:23.968: DHCP_SNOOPING: process new DHCP packet, message type: DHCPDISCOVER, input interface: Po1, MAC da: ffff.ffff.ffff, MAC sa: 3037.a696.3640, IP da: 255.255.255.255, IP sa: 0.0.0.0, DHCP ciaddr: 0.0.0.0, DHCP yiaddr: 0.0.0.0, DHCP siaddr: 0.0.0.0, DHCP giaddr: 0.0.0.0, DHCP chaddr: 3037.a696.3640 Mar 30 01:30:23.968: DHCP_SNOOPING_SW: bridge packet get invalid mat entry: FFFF.FFFF.FFFF, packet is flooded to ingress VLAN: (1) Mar 30 01:30:23.968: DHCP_SNOOPING_SW: bridge packet send pac 2960-1#ket to cpu port: Vlan1. Mar 30 01:30:25.976: DHCPSNOOP(hlfm_set_if_input): Setting if_input to Gi0/24 for pak. Was Vl1 Mar 30 01:30:25.976: DHCPSNOOP(hlfm_set_if_input): Setting if_input to Vl1 for pak. Was Gi0/24 Mar 30 01:30:25.976: DHCPSNOOP(hlfm_set_if_input): Setting if_input to Gi0/24 for pak. Was Vl1 Mar 30 01:30:25.976: DHCP_SNOOPING: received new DHCP packet from input interface (GigabitEthernet0/24) Mar 30 01:30:25.976: DHCP_SNOOPING: process new DHCP packet, message type: DHCPOFFER, inpu 2960-1#t interface: Gi0/24, MAC da: ffff.ffff.ffff, MAC sa: 001c.0e86.6f4a, IP da: 255.255.255.255, IP sa: 172.16.156.33, DHCP ciaddr: 0.0.0.0, DHCP yiaddr: 172.16.156.47, DHCP siaddr: 0.0.0.0, DHCP giaddr: 0.0.0.0, DHCP chaddr: 3037.a696.3640 Mar 30 01:30:25.981: DHCP_SNOOPING: direct forward dhcp replyto output port: Port-channel1. Mar 30 01:30:25.987: DHCPSNOOP(hlfm_set_if_input): Setting if_input to Po1 for pak. Was Vl1 Mar 30 01:30:25.987: DHCPSNOOP(hlfm_set_if_input): Setting if_input to Vl1 for pak. W 2960-1#as Po1 Mar 30 01:30:25.987: DHCPSNOOP(hlfm_set_if_input): Setting if_input to Po1 for pak. Was Vl1 Mar 30 01:30:25.987: DHCP_SNOOPING: received new DHCP packet from input interface (Port-channel1) Mar 30 01:30:25.987: DHCP_SNOOPING: process new DHCP packet, message type: DHCPREQUEST, input interface: Po1, MAC da: ffff.ffff.ffff, MAC sa: 3037.a696.3640, IP da: 255.255.255.255, IP sa: 0.0.0.0, DHCP ciaddr: 0.0.0.0, DHCP yiaddr: 0.0.0.0, DHCP siaddr: 0.0.0.0, DHCP giaddr: 0.0.0.0, DHCP chaddr: 3037.a696.3 2960-1#640 Mar 30 01:30:25.987: DHCP_SNOOPING_SW: bridge packet get invalid mat entry: FFFF.FFFF.FFFF, packet is flooded to ingress VLAN: (1) Mar 30 01:30:25.987: DHCP_SNOOPING_SW: bridge packet send packet to cpu port: Vlan1. Mar 30 01:30:25.987: DHCPSNOOP(hlfm_set_if_input): Setting if_input to Gi0/24 for pak. Was Vl1 Mar 30 01:30:25.987: DHCPSNOOP(hlfm_set_if_input): Setting if_input to Vl1 for pak. Was Gi0/24 Mar 30 01:30:25.987: DHCPSNOOP(hlfm_set_if_input): Setting if_input to Gi0/24 for pak. Was Vl 2960-1#1 Mar 30 01:30:25.987: DHCP_SNOOPING: received new DHCP packet from input interface (GigabitEthernet0/24) Mar 30 01:30:25.992: DHCP_SNOOPING: process new DHCP packet, message type: DHCPACK, input interface: Gi0/24, MAC da: ffff.ffff.ffff, MAC sa: 001c.0e86.6f4a, IP da: 255.255.255.255, IP sa: 172.16.156.33, DHCP ciaddr: 0.0.0.0, DHCP yiaddr: 172.16.156.47, DHCP siaddr: 0.0.0.0, DHCP giaddr: 0.0.0.0, DHCP chaddr: 3037.a696.3640 Mar 30 01:30:25.992: DHCP_SNOOPING: direct forward dhcp replyto output port: 2960-1#Port-channel1. 2960-1#sh ip dhc 2960-1#sh ip dhcp no 2960-1#sh ip dhcp sno 2960-1#sh ip dhcp snooping b 2960-1#sh ip dhcp snooping binding MacAddress IpAddress Lease(sec) Type VLAN Interface ------------------ --------------- ---------- ------------- ---- -------------------- 30:37:A6:96:36:40 172.16.156.47 86387 dhcp-snooping 1 Port-channel1 Total number of bindings: 1 2960-1#sh ver | in IOS Cisco IOS Software, C2960S Software (C2960S-UNIVERSALK9-M), Version 15.0(2)SE5, RELEASE SOFTWARE (fc1) 2960-1#
... View more
11-10-2013
09:59 PM
Aurelien I see from the SE5 that the DHCP binding table was not populating. I am looking to test this in the lab. However, I would recommend at this point opening a TAC case so can track this.
... View more
Created by
Colby Beam
in Networking Documents
in Networking Documents
11-10-2013
05:54 PM
11-10-2013
05:54 PM
Introduction The 3850 now has a wireshark feature, so it is possible to do packet captures. This decreases the requirement for SPAN captures when troubleshooting. Reference CCO: http://www.cisco.com/en/US/docs/switches/lan/catalyst3850/software/release/3se/network_management/configuration_guide/b_nm_3se_3850_cg_chapter_01000.html Requires and Restrictions 3.3.0 IOS-EX or higher required Limiting circular file storage by file size is not supported During Wireshark packet capture, hardware forwarding happens concurrently Capture filters are not supported . Matching on ACL is supported CPU-injected packets are considered control plane packets. Therefore, these types of packets will not be captured on an interface egress capture Layer 2 and Layer 3 EtherChannels are not supported MAC ACL is only used for non-IP packets such as ARP. It will not be supported on a Layer 3 port or SVI. More listed on CCO Few extra notes When WireShark is used on switches in a stack, packet captures can be stored only on flash or USB flash devices connected to the active switch. For example, if flash1 is connected to the active switch, and flash2 is connected to the secondary switch, only flash1 can be used to store packet captures.Attempts to store packet captures on devices other than flash or USB flash devices connected to the active switch will probably result in errors. Decoding and displaying packets may be CPU intensive Because packet forwarding typically occurs in hardware, packets are not copied to the CPU for software processing. For Wireshark packet capture, packets are copied and delivered to the CPU, which causes an increase in CPU usage. To avoid high CPU usage, do the following: Attach only relevant ports. Use a class map, and secondarily, an access list to express match conditions. If neither is viable, use an explicit, in-line filter. Adhere closely to the filter rules. Restrict the traffic type (such as, IPv4 only) with a restrictive, rather than relaxed CL, which elicits unwanted traffic The capture buffer can be in linear or circular mode. In linear mode, new packets are discarded when the buffer is full. In circular mode, if the buffer is full, the oldest packets are discarded to accommodate the new packets. Although the buffer can also be cleared when needed, this mode is mainly used for debugging network traffic. When a Wireshark capture point is activated, a fixed rate policer is applied automatically in the hardware so that the CPU is not flooded with Wireshark-directed packets. The disadvantage of the rate policer is that you cannot capture contiguous packets beyond the established rate even if more resources are available. VLANs —When a VLAN is used as a Wireshark attachment point, packets are captured in the input direction only How to Capture Define your source monitor capture mycap interface GigabitEthernet1/0/1 both Set your match statement monitor capture mycap access-list myacl <--- match on acl monitor capture mycap match ipv4 any any <--- match any is only supported currently Set your destination monitor capture mycap file location flash:mycap.pcap buffer-size 10 <--- 10mb buffer monitor capture mycap file location usbflash0:<file_name> buffer-size 10 <--- save to usb (Optional): set packet limit and/or duration monitor capture mycap limit packets 100 duration <number_of_seconds> Demo IXIA connected to Gi1/0/1 - 10.10.10.10 Int vlan 10 - 10.10.10.1 F340.09.11-3800-1#sh mac address-table dynamic
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
1 aaaa.aaaa.aaaa DYNAMIC Gi1/0/1 <--- HOST 1 d0c7.8971.6b02 DYNAMIC Gi1/0/2 <--- Neighbor 3850 Verification 340.09.11-3800-1#show monitor capture mycap parameter monitor capture mycap interface GigabitEthernet1/0/1 both
monitor capture mycap match ipv4 any any
monitor capture mycap file location flash:mycap.pcap buffer-size 10
monitor capture mycap limit packets 100
Start the Capture F340.09.11-3800-1#monitor capture mycap startA file by the same capture file name already exists, overwrite?[confirm] <-- if file already exist it can overwrite Capture Running F340.09.11-3800-1#show monitor capture mycap
Status Information for Capture mycap
Target Type:
Interface: GigabitEthernet1/0/1, Direction: both
Status : Active Filter Details:
IPv4
Source IP: any
Destination IP: any
Protocol: any
Buffer Details:
Buffer Type: LINEAR (default)
File Details:
Associated file name: flash:mycap.pcap
Size of buffer(in MB): 10
Limit Details:
Number of Packets to capture: 100
Packet Capture duration: 0 (no limit)
Packet Size to capture: 0 (no limit)
Packets per second: 0 (no limit)
Packet sampling rate: 0 (no sampling)
Stop Capture F340.09.11-3800-1#monitor capture mycap stop View Capture F340.09.11-3800-1#show monitor capture file flash:mycap.pcap 1 0.000000 10.10.10.10 -> 10.10.10.1 IP Unknown (0xff)
2 0.000992 10.10.10.10 -> 10.10.10.1 IP Unknown (0xff)
3 0.000992 10.10.10.10 -> 10.10.10.1 IP Unknown (0xff)
4 0.000992 10.10.10.10 -> 10.10.10.1 IP Unknown (0xff)
5 0.000992 10.10.10.10 -> 10.10.10.1 IP Unknown (0xff) View Capture (display filter) F340.09.11-3800-1#show monitor capture file flash:mycap.pcap dis "eth.addr==0c:68:03:45:e5:47"1 0.000000 aa:aa:aa:aa:aa:aa -> 0c:68:03:45:e5:47 ARP Who has 10.10.10.1? Tell 10.10.10.10
2 0.001999 aa:aa:aa:aa:aa:aa -> 0c:68:03:45:e5:47 ARP Who has 10.10.10.1? Tell 10.10.10.10
3 0.009003 aa:aa:aa:aa:aa:aa -> 0c:68:03:45:e5:47 ARP Who has 10.10.10.1? Tell 10.10.10.10 View Capture (detailed) F340.09.11-3800-1#show monitor capture file flash:mycap.pcap detailedFrame 1: 1396 bytes on wire (11168 bits), 1396 bytes captured (11168 bits)
Arrival Time: Oct 9, 2013 12:15:29.371974000 UTC
Epoch Time: 1381320929.371974000 seconds
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 1396 bytes (11168 bits)
Capture Length: 1396 bytes (11168 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:data]
Ethernet II, Src: aa:aa:aa:aa:aa:aa (aa:aa:aa:aa:aa:aa), Dst: 0c:68:03:45:e5:47 (0c:68:03:45:e5:47) Destination: 0c:68:03:45:e5:47 (0c:68:03:45:e5:47)
Address: 0c:68:03:45:e5:47 (0c:68:03:45:e5:47)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Source: aa:aa:aa:aa:aa:aa (aa:aa:aa:aa:aa:aa) Address: aa:aa:aa:aa:aa:aa (aa:aa:aa:aa:aa:aa)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
Type: IP (0x0800)
Internet Protocol, Src: 10.10.10.10 (10.10.10.10), Dst: 10.10.10.1 (10.10.10.1) Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 1382
Identification: 0x0000 (0)
Flags: 0x00
0... .... = Reserved bit: Not set
.0.. .... = Don't fragment: Not set
..0. .... = More fragments: Not set
Fragment offset: 0
Time to live: 64 Protocol: Unknown (255) Header checksum: 0x4c7b [correct]
[Good: True]
[Bad: False]
Source: 10.10.10.10 (10.10.10.10)
Destination: 10.10.10.1 (10.10.10.1)
Data (1362 bytes)
0000 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f ................
0010 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f ................
0020 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f !"#$%&'()*+,-./
0030 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 0123456789:;<=>?
0040 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f @ABCDEFGHIJKLMNO
0050 50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f PQRSTUVWXYZ[\]^_
0060 60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f `abcdefghijklmno
0070 70 71 72 73 74 75 76 77 78 79 7a 7b 7c 7d 7e 7f pqrstuvwxyz{|}~.
0080 80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f ................
0090 90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f ................
00a0 a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af ................
00b0 b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf ................
00c0 c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf ................
00d0 d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df ................
00e0 e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef ................
00f0 f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe ff ................
0100 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f ................
0110 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f ................
0120 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f !"#$%&'()*+,-./
0130 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 0123456789:;<=>?
0140 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f @ABCDEFGHIJKLMNO
0150 50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f PQRSTUVWXYZ[\]^_
0160 60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f `abcdefghijklmno
0170 70 71 72 73 74 75 76 77 78 79 7a 7b 7c 7d 7e 7f pqrstuvwxyz{|}~.
0180 80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f ................
0190 90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f ................
01a0 a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af ................
01b0 b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf ................
01c0 c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf ................
01d0 d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df ................
01e0 e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef ................
01f0 f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe ff ................
0200 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f ................
0210 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f ................
0220 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f !"#$%&'()*+,-./
0230 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 0123456789:;<=>?
0240 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f @ABCDEFGHIJKLMNO
0250 50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f PQRSTUVWXYZ[\]^_
0260 60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f `abcdefghijklmno
0270 70 71 72 73 74 75 76 77 78 79 7a 7b 7c 7d 7e 7f pqrstuvwxyz{|}~.
0280 80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f ................
0290 90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f ................
02a0 a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af ................
02b0 b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf ................
02c0 c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf ................
02d0 d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df ................
02e0 e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef ................
02f0 f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe ff ................
0300 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f ................
0310 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f ................
0320 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f !"#$%&'()*+,-./
0330 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 0123456789:;<=>?
0340 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f @ABCDEFGHIJKLMNO
0350 50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f PQRSTUVWXYZ[\]^_
0360 60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f `abcdefghijklmno
0370 70 71 72 73 74 75 76 77 78 79 7a 7b 7c 7d 7e 7f pqrstuvwxyz{|}~.
0380 80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f ................
0390 90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f ................
03a0 a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af ................
03b0 b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf ................
03c0 c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf ................
03d0 d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df ................
03e0 e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef ................
03f0 f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe ff ................
0400 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f ................
0410 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f ................
0420 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f !"#$%&'()*+,-./
0430 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 0123456789:;<=>?
0440 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f @ABCDEFGHIJKLMNO
0450 50 51 52 53 54 55 56 57 58 59 5a 5b 5c 5d 5e 5f PQRSTUVWXYZ[\]^_
0460 60 61 62 63 64 65 66 67 68 69 6a 6b 6c 6d 6e 6f `abcdefghijklmno
0470 70 71 72 73 74 75 76 77 78 79 7a 7b 7c 7d 7e 7f pqrstuvwxyz{|}~.
0480 80 81 82 83 84 85 86 87 88 89 8a 8b 8c 8d 8e 8f ................
0490 90 91 92 93 94 95 96 97 98 99 9a 9b 9c 9d 9e 9f ................
04a0 a0 a1 a2 a3 a4 a5 a6 a7 a8 a9 aa ab ac ad ae af ................
04b0 b0 b1 b2 b3 b4 b5 b6 b7 b8 b9 ba bb bc bd be bf ................
04c0 c0 c1 c2 c3 c4 c5 c6 c7 c8 c9 ca cb cc cd ce cf ................
04d0 d0 d1 d2 d3 d4 d5 d6 d7 d8 d9 da db dc dd de df ................
04e0 e0 e1 e2 e3 e4 e5 e6 e7 e8 e9 ea eb ec ed ee ef ................
04f0 f0 f1 f2 f3 f4 f5 f6 f7 f8 f9 fa fb fc fd fe ff ................
0500 00 01 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f ................
0510 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f ................
0520 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f !"#$%&'()*+,-./
0530 30 31 32 33 34 35 36 37 38 39 3a 3b 3c 3d 3e 3f 0123456789:;<=>?
0540 40 41 42 43 44 45 46 47 48 49 4a 4b 4c 4d 4e 4f @ABCDEFGHIJKLMNO
0550 50 51 PQ
Data: 000102030405060708090a0b0c0d0e0f1011121314151617...
[Length: 1362]
Sample ARP Capture *note: CPU-injected packets are considered control plane packets. Therefore, these types of packets will not be captured on an interface egress capture F340.09.11-3800-1#sh mon cap mycap par monitor capture mycap interface GigabitEthernet1/0/1 both
monitor capture mycap match any <-- must do any here monitor capture mycap file location flash:mycap.pcap buffer-size 10
monitor capture mycap limit packets 100
F340.09.11-3800-1#show monitor capture file flash:mycap.pcap
1 0.000000 aa:aa:aa:aa:aa:aa -> 0c:68:03:45:e5:47 ARP Who has 10.10.10.1? Tell 10.10.10.10
2 0.000000 aa:aa:aa:aa:aa:aa -> 0c:68:03:45:e5:47 ARP Who has 10.10.10.1? Tell 10.10.10.10
3 0.000000 aa:aa:aa:aa:aa:aa -> 0c:68:03:45:e5:47 ARP Who has 10.10.10.1? Tell 10.10.10.10
4 0.000000 aa:aa:aa:aa:aa:aa -> 0c:68:03:45:e5:47 ARP Who has 10.10.10.1? Tell 10.10.10.10
5 0.000000 aa:aa:aa:aa:aa:aa -> 0c:68:03:45:e5:47 ARP Who has 10.10.10.1? Tell 10.10.10.10
6 0.000000 aa:aa:aa:aa:aa:aa -> 0c:68:03:45:e5:47 ARP Who has 10.10.10.1? Tell 10.10.10.10
F340.09.11-3800-1#show monitor capture file flash:mycap.pcap
1 0.000000 aa:aa:aa:aa:aa:aa -> 0c:68:03:45:e5:47 ARP Who has 10.10.10.1? Tell 10.10.10.10
2 0.000000 aa:aa:aa:aa:aa:aa -> 0c:68:03:45:e5:47 ARP Who has 10.10.10.1? Tell 10.10.10.10
3 0.000000 aa:aa:aa:aa:aa:aa -> 0c:68:03:45:e5:47 ARP Who has 10.10.10.1? Tell 10.10.10.10
4 0.000000 aa:aa:aa:aa:aa:aa -> 0c:68:03:45:e5:47 ARP Who has 10.10.10.1? Tell 10.10.10.10
5 0.000000 aa:aa:aa:aa:aa:aa -> 0c:68:03:45:e5:47 ARP Who has 10.10.10.1? Tell 10.10.10.10
6 0.000000 aa:aa:aa:aa:aa:aa -> 0c:68:03:45:e5:47 ARP Who has 10.10.10.1? Tell 10.10.10.10
F340.09.11-3800-1#sh int vlan 1Vlan1 is up, line protocol is up
Hardware is Ethernet SVI, address is 0c68.0345.e547 (bia 0c68.0345.e547 ) <----------- Control Plane Capture (packets ingress or egress to CPU) Flooding the 3850 with a arp request from 10.10.10.10 Set your capture to be control-plane
F340.09.11-3800-1#monitor capture mycap control-plane ?
both Inbound and outbound packets
in Inbound packets
out Outbound packets F340.09.11-3800-1#sh mon cap mycap par monitor capture mycap control-plane both
monitor capture mycap match any
monitor capture mycap file location flash:mycap.pcap buffer-size 10
monitor capture mycap limit packets 100 <--- will become inactive after 100 packets F340.09.11-3800-1# s h mon cap mycap Status Information for Capture mycap
Target Type:
Interface: Control Plane, Direction : both
Status : Inactive Filter Details:
Capture all packets
Buffer Details:
Buffer Type: LINEAR (default)
File Details:
Associated file name: flash:mycap.pcap
Size of buffer(in MB): 10
Limit Details:
Number of Packets to capture: 100
Packet Capture duration: 0 (no limit)
Packet Size to capture: 0 (no limit)
Packets per second: 0 (no limit)
Packet sampling rate: 0 (no sampling) F340.09.11-3800-1# show mon capture file flash:mycap.pca p1 0.143990 aa:aa:aa:aa:aa:aa -> 0c:68:03:45:e5:47 ARP Who has 10.10.10.1? Tell 10.10.10.10
2 0.148003 aa:aa:aa:aa:aa:aa -> 0c:68:03:45:e5:47 ARP Who has 10.10.10.1? Tell 10.10.10.10
3 0.153999 aa:aa:aa:aa:aa:aa -> 0c:68:03:45:e5:47 ARP Who has 10.10.10.1? Tell 10.10.10.10
4 0.159004 aa:aa:aa:aa:aa:aa -> 0c:68:03:45:e5:47 ARP Who has 10.10.10.1? Tell 10.10.10.10
5 0.163993 aa:aa:aa:aa:aa:aa -> 0c:68:03:45:e5:47 ARP Who has 10.10.10.1? Tell 10.10.10.10
6 0.168998 aa:aa:aa:aa:aa:aa -> 0c:68:03:45:e5:47 ARP Who has 10.10.10.1? Tell 10.10.10.10
7 0.174003 aa:aa:aa:aa:aa:aa -> 0c:68:03:45:e5:47 ARP Who has 10.10.10.1? Tell 10.10.10.10
8 0.178992 0c:68:03:45:e5:47 -> aa:aa:aa:aa:aa:aa ARP 10.10.10.1 is at 0c:68:03:45:e5:47
9 0.184988 0c:68:03:45:e5:47 -> aa:aa:aa:aa:aa:aa ARP 10.10.10.1 is at 0c:68:03:45:e5:47
10 0.189993 0c:68:03:45:e5:47 -> aa:aa:aa:aa:aa:aa ARP 10.10.10.1 is at 0c:68:03:45:e5:47
11 0.194998 0c:68:03:45:e5:47 -> aa:aa:aa:aa:aa:aa ARP 10.10.10.1 is at 0c:68:03:45:e5:47
12 0.200994 0c:68:03:45:e5:47 -> aa:aa:aa:aa:aa:aa ARP 10.10.10.1 is at 0c:68:03:45:e5:47
13 0.205999 0c:68:03:45:e5:47 -> aa:aa:aa:aa:aa:aa ARP 10.10.10.1 is at 0c:68:03:45:e5:47
14 0.210988 0c:68:03:45:e5:47 -> aa:aa:aa:aa:aa:aa ARP 10.10.10.1 is at 0c:68:03:45:e5:47
15 0.215993 0c:68:03:45:e5:47 -> aa:aa:aa:aa:aa:aa ARP 10.10.10.1 is at 0c:68:03:45:e5:47
16 0.221989 0c:68:03:45:e5:47 -> aa:aa:aa:aa:aa:aa ARP 10.10.10.1 is at 0c:68:03:45:e5:47 The pcap can be uploaded off flash, and decoded in Wireshark as well
... View more
- Tags:
- 3850
- authentication
- capture
- catos
- cisco
- configuration
- design
- gre
- ios
- ip_routing
- isl
- lan
- network_infrastructure
- ospf
- packet
- router
- routing
- switches
- switching
- troubleshoot
- trunking
- vlan
Labels:
11-09-2013
06:50 PM
Aurelien, Prior to SE5 code there was https://tools.cisco.com/bugsearch/bug/CSCui65252, but this only pretained to ARP reply being dropped by the 3750 and ONLY if the ARP request was coming in on a port-channel. DAI was required to be on, and even though the ports were trusted, it would drop If you can elaborate more on the DHCP issue you were seeing I can test in the lab. Would need your running-config, and is this only IPv6 DHCP request? However I would get a TAC case as well opened so we can investigate further and track it.
... View more
08-18-2013
02:34 PM
Correct. HSRP and stacking of 9 switches will be out in the Sept/Oct time frame.
... View more
Created by
Colby Beam
in Switching
12-11-2013
12-11-2013
KevinThe biggest difference between thse three things (trunking,
etherchanneling, port-channeling) i...
Created by
Colby Beam
in Switching
12-10-2013
12-10-2013
KevinThe mgmt interface is in its own VRF and would be treated as a
"host" interface. You cannot put...
Created by
Colby Beam
in Switching
12-10-2013
12-10-2013
All of the switches in the stack have to have the same license levelQ.
What are the license requirem...
Created by
Colby Beam
in Switching
12-09-2013
12-09-2013
KevinAll this means is that we changed the syntax some. It will still
work, but eventually will be r...
Created by
Colby Beam
in Switching
12-09-2013
12-09-2013
KevinCould paste what configure you were attempting and what version
you're running on the 3850?Than...
Created by
Colby Beam
in Switching
12-02-2013
12-02-2013
StephenExcellent question. There is no exact documentation for the
topology you are describing, howe...
11-10-2013
Protective Boot on Certain Network Cables Might Push the Mode Button and
Cause an Unexpected
Resetht...
Created by
Colby Beam
in Switching
11-10-2013
11-10-2013
Hi Samuel,Looking into this quickly, could you try 3.2.3 or higher? I
want to make sure we are not r...
Created by
Colby Beam
in Switching
11-10-2013
11-10-2013
Hi JasonWhat version of code are you running on the 3850. I would check
to make sure you are running...
11-10-2013
I am looking to test a normal 2960, to see if there is any difference.
This may take a day or two.
11-10-2013
AurelienI just tested this on a 2960-S running SE5 with no issues.
2960-1#debug ip dhcp snooping pac...
11-10-2013
AurelienI see from the SE5 that the DHCP binding table was not
populating. I am looking to test this...
11-10-2013
IntroductionThe 3850 now has a wireshark feature, so it is possible to
do packet captures. This decr...
11-09-2013
Aurelien,Prior to SE5 code there was
https://tools.cisco.com/bugsearch/bug/CSCui65252, but this only...
Public Statistics
| Date Registered | 07-01-2011 07:43 AM |
| Date Last Visited | 03-16-2019 07:51 AM |
| Total Messages Posted | 57 |
| Total Helpful Votes Received | 56 |
Helpful Votes Given To
.jpg "VIP Mentor"){kind=icon}
Helpful Votes From
