How can i capture traffic on cisco controller to determine caus

[philasam79]

Hi all,

I have three controllers in Mobility mode. the Mobility Anchor is spontaneously flapping and I have tried to remove the mobility features and readd the peers. It was fine for a short time. Then after a few hours, it started flapping again. So, I'm wondering, how can I capture traffic on these controllers to understand what the cause. Could someone please help with this information? Here are the traps from the Anchor below. Any suggestions would be greatly appreciated.

	Wed Dec 4 14:40:59 2019	Data path to mobility member 10.10.51.xx is up.
10	Wed Dec 4 14:40:59 2019	Data path to mobility member 10.10.51.xx is down.

	Wed Dec 4 06:56:22 2019	Data path to mobility member 1010.51.xx is up.
93	Wed Dec 4 06:56:22 2019	Data path to mobility member 1010.51.xx is down.
94	Wed Dec 4 06:52:22 2019	Data path to mobility member 1010.51.xx is up.
95	Wed Dec 4 06:52:22 2019	Data path to mobility member 1010.51.xx is down.

[Rasika Nayanajith]

Are these WLCs having same version of software ? Did you notice any logs on switches that connect these WLCs , I would think some sort of layer 1 or layer 2 issue causing those flapping.

There is no easy way of capturing packets directly from WLC. So you may have to SPAN WLC trunk port traffic filtering those other WLC IP, in order to see what's going on.

Challenge is how to capture this exact flapping moment.

HTH

Rasika

*** Pls rate all useful responses ***

[philasam79]

Rasika

There are no log messages on the uplink switch they are connected and they are currently running IOS code 8.0.140.0 on all devices. I'm considering to SPAN idea. I will feed you back with the update.
Thank you

[patoberli]

I couldn't find a fixed bug sounding similar to your issue, but they fixed various roaming issues and memory leaks since your version, and thus I recommend to upgrade to 8.0.152.0 (which is the final release).
https://www.cisco.com/c/en/us/td/docs/wireless/controller/release/notes/crn80mr5.html

It does sadly contain one unfixed bug that can affect many installations, see here: https://www.cisco.com/c/en/us/support/docs/wireless/wireless-lan-controller-software/200046-tac-recommended-aireos.html#anc16
So you might want to ask TAC for this specific escalation build.

[philasam79]

i increased the Keep Alive Count  count and Keep Alive Interval on the Anchor and on one of the Peers. Initially, it was set to 3 and 10 respectively for the count and interval. After i had increased the keep alive counters from 3 and 10 to 20 and 15 respectively to allow for mobility tunnels to be more tolerant to packets lost. All devices have been stable for the past couple of hours now. I'm hoping that this fixes the issue. Thank you all for your inputs.

[patoberli]

Still go for the software upgrade, even if it's just for the fixed security issues.