NX-OS ethanalyzer: On-Box Packet Capture Guide

ethanalyzer is the Wireshark-based capture tool built into NX-OS, and it does something a SPAN session cannot: it captures the packets the supervisor itself sends and receives. When a routing protocol will not form an adjacency, when an ARP entry refuses to resolve, or when you need to prove whether a BGP update left the box at all, ethanalyzer answers the question on the device. This guide covers the capture modes, the two filter types and how to pull the capture off the switch for analysis.

What ethanalyzer can and cannot see

switch# ethanalyzer local interface inband ...
switch# ethanalyzer local interface mgmt ...

• inband — captures packets travelling between the supervisor module and the interface modules. This is where control-plane traffic lives: routing protocols, ARP, BFD, DHCP snooping messages, LLDP.
• mgmt — captures packets to or from the mgmt0 port. Use it for management-plane problems: SSH, SNMP, NTP, syslog, TACACS+, and anything the CPU owns.

ethanalyzer does not capture regular data-plane traffic forwarded in hardware. If you need that, use SPAN or ERSPAN; if you need control-plane traffic, ethanalyzer is the tool.

Capture-filter versus display-filter

This is the distinction that determines whether your capture works under load:

• capture-filter — applies during capture and keeps the capture rate high. Because full dissection has not happened, the fields available are predefined and limited.
• display-filter — applies to the temporary capture file afterwards; it supports the full Wireshark filter language but the temporary file can fill quickly because every packet is captured first and only some are displayed.

! capture only five packets involving one host
switch# ethanalyzer local interface inband capture-filter "host 10.10.10.2" limit-captured-frames 5

! capture five packets, then display only the matching subset
switch# ethanalyzer local interface inband display-filter "ip.addr==10.10.10.2" limit-captured-frames 5

! limit the size of each captured frame
switch# ethanalyzer local interface inband capture-filter "tcp port 179" limit-frame-size 128

Use the capture filter to reduce volume and the display filter to narrow the view. A common mistake is to run a display filter with no capture filter and an unlimited frame count on a busy management interface — the temporary buffer fills and the useful packets are the ones that got dropped.

Saving and reading captures

switch# ethanalyzer local interface inband write bootflash:bgp-cap.pcap
switch# ethanalyzer local interface mgmt write bootflash:mgmt-cap.pcap capture-filter "port 53"
switch# ethanalyzer local read bootflash:bgp-cap.pcap
switch# dir bootflash:*.pcap

Write to bootflash, copy the file off with copy or SCP, and analyse it in Wireshark where you have the full dissector set, colour rules and statistics. The brief option prints a protocol summary only, which is useful when you are looking for a single message type rather than conversation detail.

Common scenarios

1. BGP neighbour flapping — capture TCP port 179 on inband and look for TCP resets, keepalive gaps, or a hold timer expiring. You will see whether the switch received a notification from the peer or generated one itself.
2. SNMP timeouts from the NMS — capture on mgmt filtered by UDP 161 and confirm whether requests arrive and whether replies leave. Half the time the answer is a missing route back to the NMS subnet.
3. ARP entry never resolving — filter on arp inband and check whether requests are sent with the correct source address for the SVI. A wrong source VRF produces requests that never get a reply.
4. DHCP relay failing — capture UDP 67/68 to see whether the relayed packet is sent with the expected giaddr for the client VLAN.

Practices that keep the box safe

• Always bound the capture: limit-captured-frames plus limit-frame-size. An unbounded capture on a supervisor can affect control-plane CPU.
• Prefer a capture filter over a display filter for anything high-rate.
• Delete captures from bootflash when finished; the file sizes add up and a full bootflash causes its own outage.
• Note the platform-specific bugs before you rely on a filter — some older Nexus platforms cannot combine a capture filter with internal decode options, and capture from the CPU on certain supervisor generations was broken by a documented defect.
• Capture both directions when you are debugging an adjacency: a one-sided capture cannot distinguish "we never sent it" from "we sent it and they ignored it".

See also: NX-OS ERSPAN configuration, tcpdump filters and examples, and Wireshark PCAP analysis.

原文链接：https://www.cisco.com/c/en/us/support/docs/switches/nexus-7000-series-switches/116136-trouble-ethanalyzer-nexus7000-00.html