AOS-CX Packet Capture: tcpdump on Aruba CX Switches

Aruba AOS-CX switches are built on a Linux foundation, which means the familiar tcpdump utility is available right on the switch for packet capture — no external taps or port mirrors to a server required. This post shows how to configure a mirror session that sends traffic to the CPU, then run diag utilities tcpdump with granular Linux-style filters. You will also see how captured VXLAN-encapsulated traffic is automatically decoded so you can read the original ICMP payload inside the tunnel.

Why Packet Capture on AOS-CX Is Different

On an ASIC-based switch, most traffic never touches the CPU, so you cannot simply sniff a port like on a server. The critical first step is to configure a mirror session with the CPU as the destination:

Leaf1(config-mirror-1)# show run cur mirror
session 1
 destination cpu
 source interface 1/1/4 both
 source interface 1/1/3 both
 enable

Running tcpdump from the AOS-CX CLI

The diag command unlocks Linux utilities on the switch. The example below captures VXLAN packets (UDP 4789) in both directions using the command keyword, which accepts traditional Linux tcpdump syntax:

diag utilities tcpdump command -t udp dst port 4789 or udp src port 4789 -A

Reading VXLAN-Decoded Output

Because the original IP PDU is carried inside the VXLAN header, tcpdump displays both the outer tunnel and the inner packet. In a two-way ping across an L3 VNI you will see the VXLAN frame followed by the decapsulated ICMP echo request and reply:

IP 10.51.100.0.21484 > 10.51.100.6.4789 : VXLAN, flags I, vni 20001
IP 10.0.113.68 > 10.0.113.5 : ICMP echo request, id 10889, seq 1, length 108

This is a fast way to prove which member of a VSX pair actually received a packet, or to verify whether VXLAN traffic is being decapsulated correctly in a spine-leaf fabric.

Going Deeper with tshark

The related tshark utility is the CLI version of Wireshark and decodes packets in greater detail. A useful combination is tcpdump for very granular filtering, followed by tshark when you need to inspect a specific flag inside a field.

For related campus and data center troubleshooting, see our notes on clearing ArubaOS configuration, MLNX-OS breakout cable link troubleshooting and the SONiC troubleshooting guide.

原文链接：https://constantpinger.home.blog/2021/11/05/aruba-aos-cx-packet-capture-including-vxlan-decoding/