How to capture packets in the forwarding path on NCS 540

[aseem_rai]

hi 

I am running NCS540 with XR7.1.2 . Is there a way we can capture packets ingress/egress which are in the forwarding path . 

Also, is there any way to also capture control plane packets on this to examine them ? 

Please suggest.

Thanks

Aseem.

[tkarnani]

Hi Aseem, you can run span to file in 7.1.2

this will create a pcap on the disk, you can copy it off the router.

here is a brief guide

Configuration.

monitor-session SPAN ethernet
destination file size 10000000 buffer-type linear
!
interface Bundle-Ether51
mtu 1540
monitor-session SPAN ethernet direction rx-only
!
!

Start capture

monitor-session SPAN packet-collection start


Stop capture and write to file.

monitor-session SPAN packet-collection stop write directory /misc/disk1 filename SPANTEST


copy span file off disk to ftp

dir harddisk:/node0_0_CPU0
copy harddisk:/node0_0_CPU0/SPANTEST.pcap ftp://lab:lab@1.2.3.4

[aseem_rai]

Hello tkarnani, 

Actually this is not working for my version of NCS540 

RP/0/RP0/CPU0:LHR(config-if-mon)#show configuration failed
Sun Dec 10 02:50:16.213 IST
!! SEMANTIC ERRORS: This configuration was rejected by
!! the system due to semantic errors. The individual
!! errors with each failed configuration command can be
!! found below.

interface GigabitEthernet0/0/0/6
monitor-session SPAN ethernet
!!% 'SPAN' detected the 'warning' condition 'The platform encountered an error processing a SPAN operation': Operation not supported
!
!
end

RP/0/RP0/CPU0:LHR(config-if-mon)#show configuration
Sun Dec 10 02:50:27.484 IST
Building configuration...
!! IOS XR Configuration 7.1.2
interface GigabitEthernet0/0/0/6
monitor-session SPAN ethernet
!
!
end

RP/0/RP0/CPU0:LHR(config-if-mon)#

[anpetit]

Hello @aseem_rai , 

You need to add the "port-level" keyword in order for this to work. 

interface GigabitEthernet0/0/0/6
monitor-session SPAN ethernet port-level

Hope it resolve your issue. 

Have a wonderful day. 

Kind Regards,

Antoine