Cisco Nexus 9000 Troubleshooting Cheat Sheet: Tools

2026年8月25日 LOG admin

When traffic slows down on a Nexus 9000, the fastest path to root cause is knowing which built-in tool matches which symptom. Cisco's official Nexus cheat sheet for beginners organizes exactly that: Ethanalyzer for CPU-bound traffic, SPAN and DMirror for port mirroring, ELAM and the N9K Packet Tracer for hardware forwarding analysis, PACL/RACL/VACL for selective capture, plus OBFL and event-histories for post-mortem diagnostics. This article condenses that cheat sheet into a practical reference every NX-OS engineer should keep at hand.

Ethanalyzer: Capturing CPU-Directed Traffic

Ethanalyzer captures traffic destined to or from the CPU and is excellent for slowness, congestion and latency issues. It works like tcpdump and can be run with detail options to show full packet headers, similar to Wireshark dissection, directly in the terminal.

SPAN and DMirror

SPAN mirrors selected interfaces or VLANs to a destination port:

Nexus9000(config)# monitor session 1
Nexus9000(config-monitor)# source interface ethernet 1/1
Nexus9000(config-monitor)# destination interface ethernet 1/5
Nexus9000(config-monitor)# no shut

DMirror provides the same capture capability for CPU-directed traffic on Broadcom-based Nexus devices.

ELAM and N9K Packet Tracer

ELAM (Embedded Logic Analyzer Module) captures a single packet as it traverses the ASIC pipeline - ideal for verifying forwarding decisions and checking packet alterations. The Nexus 9000 Packet Tracer detects the path a packet takes through the hardware, useful for packet flow and forwarding issues. Both are non-intrusive but require understanding of the specific ASIC architecture.

PACL/RACL/VACL for Intermittent Packet Loss

For intermittent traffic loss, PACL/RACL/VACL capture can confirm whether packets arrive or leave a certain port or VLAN. Apply an access-list and attach it in the right direction:

Nexus9000(config)# ip access-list CAPTURE
Nexus9000(config-acl)# permit ip any any capture
Nexus9000(config)# interface ethernet 1/1
Nexus9000(config-if)# ip access-group CAPTURE in

OBFL and Event-Histories

OBFL (Onboard Failure Logging) records hardware and environment events in non-volatile storage:

Nexus93180(config)# show logging onboard module 1 ?

Event-histories log protocol and process state transitions, invaluable for understanding what happened before an issue:

Nexus93180# show ip ospf event-history ?

Debugs, EEM and Diagnostics

Targeted debugs and Embedded Event Manager (EEM) policies help automate troubleshooting. For hardware health, run show diagnostic content module all to list online tests (bootup level, per-port, disruptive and monitoring tests) available on the switch, then invoke them to verify ASIC and port health.