[IOS XR 6.1.4] Mirror traffic ACL-based

[nguyen.duy1931]

Dear all,

Now I want to capture the traffic for analyzing the enrichment header in packets. The mirroring instance is based on Layer 3 ACL. After configuring, I've connected laptop to the router and used Wireshark for capturing. But the data is very little, and there's no IP address that is matched.

The configuration is below. Please support me for checking whether it's right or not. Thanks in advance.

RP/0/RP1/CPU0:ASR9K_PE01#show running-config ipv4 access-list ACL_MIRROR_FB

Thu Jun 6 02:46:55.387 UTC
ipv4 access-list ACL_MIRROR
5 permit ipv4 any host 173.252.127.252 capture
10 permit ipv4 any host 173.252.127.254 capture
1000 permit ipv4 any any
!

RP/0/RP1/CPU0:ASR9K_PE01#show running-config interface GigabitEthernet0/10/0/1

Thu Jun 6 02:46:44.399 UTC
interface GigabitEthernet0/10/0/1   ====> connect to laptop, capture by Wireshark
carrier-delay up 2000 down 0
!

RP/0/RP1/CPU0:ASR9K_PE01#show running-config monitor-session ACL_MIRROR

Thu Jun 6 02:46:34.767 UTC
monitor-session ACL_MIRROR ethernet
destination interface GigabitEthernet0/10/0/1
!

RP/0/RP1/CPU0:ASR9K_PE01#show running-config interface be21.70

Thu Jun 6 02:46:25.742 UTC
interface Bundle-Ether21.70   ====> connect to firewall, IP private-side
vrf Gi
ipv4 address 10.1.1.1 255.255.255.252
monitor-session ACL_MIRROR ethernet
acl
!
encapsulation dot1q 70
ipv4 access-group ACL_MIRROR egress
!

[xr-escalation · Accepted solution]

does it work better if you configure interface GigabitEthernet0/10/0/1 as l2transport interface?

/Aleksandar

[nguyen.duy1931]

I will try your suggestion and feedback. Thanks.

[smilstea]

You sometimes also have to add a dot1q tag to the laptop connected interface. Just make sure wireshark is in promiscuous mode if you need to use the tag option, or even if you don't as your traffic should be tagged going towards the laptop as thats how it comes in.

Sam

[Jason M.]

If you're capturing layer 3 traffic on a layer 3 interface then remove the "ethernet" portion of the command under the interface.

Use "ethernet" if you will be capturing on an l2transport interface and l2 acl.

[nguyen.duy1931]

I've configured "l2transport" option to the observing interface. And I can capture the traffic based on L3 ACL.

Thanks for your support.