This document describes an available tool, Netdr, on Cisco Catalyst 6500 Series switches that run Supervisor Engines 720 or 32 that allows you to capture packets on the internal inband path to the Route Processor CPU (RP) or Switch Processor CPU (SP).
There are no specific requirements for this document.
The information in this document is based on the Cisco Catalyst 6500 Series switches that run Supervisor Engine 720.
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
The RP CPU is typically used in order to handle Layer 3 (L3) control traffic as well as L3 data traffic that cannot be hardware-switched. Some examples of L3 control traffic are Open Shortest Path First (OSPF), Enhanced Interior Gateway Routing Protocol (EIGRP), Border Gateway Protocol (BGP), and Protocol Independent Multicast (PIM) packets. Some examples of L3 data traffic that cannot be hardware-switched are packets with IP options set, packets with Time To Live (TTL) values of 1, and packets that require fragmentation.
The SP CPU is typically used in order to handle Layer 2 (L2) control traffic. Some examples of this are Spanning Tree Protocol (STP), Cisco Discovery Protocol (CDP), and VLAN Trunking Protocol (VTP) packets.
The Netdr tool is used in order to capture both transmit (Tx) and receive (Rx) packets on the internal inband CPU software switching path. This tool cannot be used to capture traffic that is hardware-switched.
Netdr is helpful in attempts to troubleshoot high-CPU usage scenarios. In order to check how busy the RP CPU is, issue the show process cpu command or show process cpu history command. In order to check how busy the SP CPU is, issue the remote command switch show process cpu command or remote command switch show process cpu history command.
Netdr is useful only to troubleshoot interrupt-driven, high-CPU utilization. Interrupt-driven CPU utilization is the result of processing incoming packets sent to the CPU.
Cat6500#show process cpu
CPU utilization for five seconds: 90%/81%; one minute: 89%; five minutes: 80%
In the previous example:
This section describes how to use the Netdr tool.
In order to capture packets on the RP inband CPU path, use this syntax:
Cat6500#debug netdr capture ?
acl (11) Capture packets matching an acl
and-filter (3) Apply filters in an and function: all must match
continuous (1) Capture packets continuously: cyclic overwrite
destination-ip-address (10) Capture all packets matching ip dst address
dstindex (7) Capture all packets matching destination index
ethertype (8) Capture all packets matching ethertype
interface (4) Capture packets related to this interface
or-filter (3) Apply filters in an or function: only one must match
rx (2) Capture incoming packets only
source-ip-address (9) Capture all packets matching ip src address
srcindex (6) Capture all packets matching source index
tx (2) Capture outgoing packets only
vlan (5) Capture packets matching this vlan number
In order to capture packets on the SP inband CPU path, you must run all of the commands from the SP console.
Cat6500#remote login switch
Trying Switch ...
Entering CONSOLE for Switch
Type "^C^C^C" to end this session
Cat6500-sp#debug netdr capture ?
Once the packets are captured, they are displayed with the show netdr capture command.
Here are some of the available options for Netdr:
Complete these steps in order to troubleshoot with Netdr:
Cat6500#debug netdr capture rx
Cat6500#show netdr capture
A total of 4096 packets have been captured
The capture buffer wrapped 0 times
Total capture capacity: 4096 packets
------- dump of incoming inband packet -------
interface NULL, routine mistral_process_rx_packet_inlin, timestamp 06:35:39.498
dbus info: src_vlan 0x3F1(1009), src_indx 0x102(258), len 0x40(64)
bpdu 0, index_dir 1, flood 0, dont_lrn 1, dest_indx 0x387(903)
05000018 03F16000 01020000 40000000 00117F00 00157F00 00100000 03870000
mistral hdr: req_token 0x0(0), src_index 0x102(258), rx_offset 0x76(118)
requeue 0, obl_pkt 0, vlan 0x3F1(1009)
destmac 00.1A.A2.2D.B3.A4, srcmac 00.00.00.00.AA.AA, protocol 0800
protocol ip: version 0x04, hlen 0x05, tos 0x00, totlen 46, identifier 8207
df 0, mf 0, fo 0, ttl 32, >src 127.0.0.16, dst 127.0.0.21
udp src 68, dst 67 len 26 checksum 0xB8BC
Review the packets in order to identify the top talkers and trends. You can use the "| include" option in order to search based on fields such as Source MAC (srcmac) address, Destination MAC (destmac) address, Source and Destination (src & dst) IP addresses, and Source Index (src_indx).
Cat6500#show netdr capture | include srcmac
destmac 00.1A.A2.2D.B3.A4, srcmac 00.00.00.00.AA.AA, protocol 0800
destmac 00.1A.A2.2D.B3.A4, srcmac 00.00.00.00.AA.AA, protocol 0800
destmac 00.1A.A2.2D.B3.A4, srcmac 00.00.00.00.AA.AA, protocol 0800
destmac 00.1A.A2.2D.B3.A4, srcmac 00.00.00.00.AA.AA, protocol 0800
destmac 00.1A.A2.2D.B3.A4, srcmac 00.00.00.00.AA.AA, protocol 86DD
destmac 00.1A.A2.2D.B3.A4, srcmac 00.00.00.00.AA.AA, protocol 86DD
destmac 00.1A.A2.2D.B3.A4, srcmac 00.00.00.00.AA.AA, protocol 86DD
Cat6500#show netdr capture | inc src_indx
dbus info: src_vlan 0x3F1(1009), src_indx 0x102(258), len 0x40(64)
dbus info: src_vlan 0x3F1(1009), src_indx 0x102(258), len 0x40(64)
dbus info: src_vlan 0x3F1(1009), src_indx 0x102(258), len 0x40(64)
dbus info: src_vlan 0x3F1(1009), src_indx 0x102(258), len 0x40(64)
dbus info: src_vlan 0x3F1(1009), src_indx 0x102(258), len 0x54(84)
dbus info: src_vlan 0x3F1(1009), src_indx 0x102(258), len 0x54(84)
dbus info: src_vlan 0x3F1(1009), src_indx 0x102(258), len 0x54(84)
Cat6500#remote command switch test mcast ltl-info index 102
index 0x102 contain ports 5/3
! This is the physical interface sourcing the packet going to the CPU.
Cat6500#remote command switch test mcast ltl-info index 387
index 0x387 contain ports 5/R
!5/R refers to RP CPU on the supervisor engine in slot 5