Packet Capture

A basic packet capture feature is enabled when the Cisco Nexus 3550-F Fusion (formerly ExaLINK Fusion) is fitted with the latest model Line Card. This allows the user to see packets traversing the high speed data plane on the CLI, which is very useful during commissioning, debugging etc.

Clearly it is not possible for the CLI to capture traffic flowing at line rate, so this intention of this feature is for packet capture when there is a small amount of traffic flowing on the wire.

In order to capture traffic flowing into a port, the packet-dump command should be used on the desired port as follows:

admin@N3550-F> config port c1 packet-dump
22:10:51.779814 ARP, Request who-has 192.168.10.20 (ff:ff:ff:ff:ff:ff) tell 192.168.10.10, length 46
        0x0000:  ffff ffff ffff 643f 5f01 2700 0806 0001  ......d?_.'.....
        0x0010:  0800 0604 0001 643f 5f01 2700 c0a8 0a0a  ......d?_.'.....
        0x0020:  ffff ffff ffff c0a8 0a14 0000 0000 0000  ................
        0x0030:  0000 0000 0000 0000 0000 0000            ............

Alternatively, the packet can be piped into tcpdump to facilitate specific flags to be used. This is done by adding the raw parameter to the packet-dump command, then piping this into tcpdump. Note that tcpdump dump must be invoked with the -r - flags so it takes input from stdin, as follows:

admin@N3550-F> port c1 packet-dump raw | tcpdump -r - -n -vvv -x
07:32:14.453680 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.23.1 tell 192.168.23.22, length 46
        0x0000:  0001 0800 0604 0001 643f 5f01 2ea2 c0a8
        0x0010:  1716 0000 0000 0000 c0a8 1701 0000 0000
        0x0020:  0000 0000 0000 0000 0000 0000 0000
07:32:15.456001 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.23.1 tell 192.168.23.22, length 46
        0x0000:  0001 0800 0604 0001 643f 5f01 2ea2 c0a8
        0x0010:  1716 0000 0000 0000 c0a8 1701 0000 0000
        0x0020:  0000 0000 0000 0000 0000 0000 0000

NoteNote that the port must be used as part of a config in order for the packet capture function to work.

NoteLine Cards that have a Hardware Type of LC10G-02 or LC10G-03 do not support this feature.

The output of show version can be used to determine the model of line card installed into the Nexus 3550-F.