思科nexus交换机Ethanalyzer使用

Make sure you select the appropriate CPU Queue (Inbound-hi, inbound-lo, or mgmt).

常用的流量类型:

• Inbound-low - SUP-low (eth3) (Address Resolution Protocol (ARP)/IP over switch virtual interface, Internet Group Management Protocol Snooping)
• Inbound-hi - SUP-high (eth4) (STP, FIP, Fibre Channel over Ethernet (FCoE), FC, Cisco Discovery Protocol, Link Layer Discovery Protocol/Data Center Bridging Capabilities Exchange Protocol, Link Aggregation Control Protocol, Unidirectional Link Detection)
• Mgmt - Out-Of-Band (anything through mgmt0 interface)
• FIP (Fabric Login, Clear Virtual Link, FKA): VLAN.etype==0x8914
• FCoE (Port Login, Domain Name System): VLAN.etype==0x8906

抓icmp报文示例：

Ethanalyzer local interface inbound-low capture-filter icmp&ip.addr==182.254.12.131

下面是抓FIP and FCoE示例

ethanalyzer local interface inbound-hi display-filter "vlan.etype==0x8914 || vlan.etype==0x8906"

下面是arp报文示例

Nexus# ethanalyzer local interface inbound-low display-filter arp.src.hw_mac==0013.8066.8ac2

Capturing on eth3

2012-07-12 21:23:54.643346 00:13:80:66:8a:c2 ->

ff:ff:ff:ff:ff:ff ARP Who has 172.18.121.59?  Tell 172.18.121.1

 

Nexus# ethanalyzer local interface inbound-low display-filter

arp.src.proto_ipv4==172.18.121.4

Capturing on eth3

2012-07-12 21:25:38.767772 00:05:73:ab:29:fc ->

ff:ff:ff:ff:ff:ff ARP Who has 172.18.121.1?  Tell 172.18.121.4

bpdu抓包示例

Nexus-5000# ethanalyzer local interface inbound-hi display-filter "vlan.id

== 1 && stp" 

STP on vPC Orphan Ports

Packet capture on vPC orphan port off of first Nexus 7000 Series Switch shows Source MAC address of outgoing BPDUs is based on port MAC address, both for vPC and non-vPC vlans.

#Nexus7000-1# show interface ethernet 3/13

Ethernet3/13 is up

admin state is up, Dedicated Interface

Hardware: 10000 Ethernet, address: 503d.e5b8.7298 (bia 503d.e5b8.7298)

Nexus7000-1# ethanalyzer local interface inband-out display-filter stp limit-captured-frames 1000 | include b8:72:98
Capturing on inband
2017-07-16 04:47:17.383777 Cisco_b8:72:98 -> Spanning-tree-(for-bridges)_00 STP 60 RST. Root = 0/1/a4:4c:11:6a:24:41  Cost = 2  P

Note: Use of port MAC address as the Source MAC address field in outgoing BPDUs is the default behaviour on Cisco Nexus Series Switch and Cisco Catalyst Series Switch platforms.

参考文档：

来自 <Understand Source MAC Address Field in Spanning-Tree PDUs on Nexus Series Switches - Cisco

  来自 <Spanning Tree Protocol Troubleshooting on a Nexus 5000 Series Switch - Cisco>  

Nexus 3000/5000/7000 Use of the Ethanalyzer Tool - CiscoThis document describes how to use the built-in packet capture tool, Ethanalyzer, on the Nexus 3000/5000/7000 switches.https://www.cisco.com/c/en/us/support/docs/switches/nexus-5000-series-switches/116201-technote-ethanalyzer-00.html?dtid=osscdc000283