Monitoring and Capturing Packets
There may be times when it is necessary to analyze packets as they traverse the wire when you are troubleshooting complex or obscure problems. While there are many products available which can be used to view captured packets on the wire, the TSHOOT certification exam places emphasis on understanding only how to redirect this captured information from Cisco IOS routers and switches to the appropriate application.
Cisco IOS software supports different packet capture mechanisms depending on whether or not the device is a router or a switch. On Cisco IOS software-switching routers, such as the Cisco 1800, 2800, and 3800 series routers running IOS 12.4T or 15.x, the Route IP Traffic Export (RITE) tool allows network administrators to configure the router to export IP packets received on multiple, simultaneous WAN or LAN interfaces to a single LAN or VLAN interface, to which a protocol analyzer or monitoring application is connected. The Router IP Traffic Export feature can also allow you to configure the router to capture IP packets in a buffer within the router, and then to dump the packets into a specified memory device.
When using RITE, you can configure the router to filter copied packets using either an ACL or sampling. Sampling allows you to export only one in every few packets in which you are interested. This option should be used if you do not need to capture all incoming traffic. This option can also be used when a monitored ingress interface can send traffic faster than the egress interface can transmit it. An example would be when capturing incoming traffic on a GigabitEthernet interface and exporting it out of a FastEthernet interface.
When RITE is configured, by default only incoming (inbound) traffic is exported or captured. However, RITE can be configured to capture bidirectional (inbound and outbound) traffic. Router IP Traffic Export is configured using IP traffic export profiles. Multiple profiles can be configured on the same router. The following section lists and describes the sequence of configurations steps required to configure the RITE feature in IOS software-based routers:
- Configure a traffic export profile using the ip traffic-export profile <name> global configuration command
- In RITE configuration mode, specify the interface on which the captured packets will be sent using the interface <name> configuration command
- Next, specify the MAC address of the destination host that will be receiving the packet capture using the mac-address <address> RITE configuration command. Remember that the router interface may be connected to a switch and reside in a VLAN with multiple hosts. If the MAC address is not specified, the profile will not recognize a destination host in which to send the exported packets
- And finally, apply the IP traffic export profile to an ingress interface using the ip traffic-export apply <name> interface configuration command
- Begin the IP traffic capture using the traffic-export interface <name> start privileged exec command. You can also stop the traffic capture using the traffic-export interface <name> stop privileged exec command. Additional options that can be specified include the traffic-export interface <name> clear privileged exec command which clears the buffer, and the traffic-export interface <name> copy <destination> command which can be used to copy the traffic capture to a TFTP server, Flash memory or an onboard USB device:
In addition to these required commands, additional optional commands can be specified when configuring RITE. These optional commands are described in the following section:
- Optionally, you can configure the router to capture bidirectional packets using thebidirectional RITE configuration command
- Optionally, you can configure filtering for incoming traffic using the incoming [access-list <standard | extended | named> | sample one-in-every <packet-number>] RITE configuration command. Inbound filtering is enabled by default after you create the RITE profile
- And finally, you can also optionally filter outgoing traffic using the outgoing [access-list <standard | extended | named> | sample one-in-every <packet-number>] RITE configuration command
The following configuration example illustrates how to configure RITE on a router. The router will be configured to send captured traffic to a device with MAC address 1234.abcd.5678 residing off the GigabitEthernet0/1 interface. In addition, the router will also be configured to sample one in every ten packets. The capture will be for inbound and outbound traffic. And finally, the profile will be applied to the GigabitEthernet0/0 interface:
| R4(config)#ip traffic-export profile TSHOOT R4(conf-rite)#interface gigabitethernet0/1 R4(conf-rite)#mac-address 1234.abcd.5678 R4(conf-rite)#incoming sample one-in-every 10 R4(conf-rite)#outgoing sample one-in-every 10 R4(conf-rite)#bidirectional R4(conf-rite)#exit R4(config)#interface gigabitethernet 0/0 R4(config-if)#ip traffic-export apply TSHOOT R4(config-if)# *Oct 24 21:08:48.734: %RITE-5-ACTIVATE: Activated IP traffic export on interface GigabitEthernet0/0 |
After enabling RITE on a particular interface, the router automatically generates the message that can be seen above. When the profile is removed, the following is displayed:
| R4(config)#int g0/0 R4(config-if)#no ip traffic-export apply TSHOOT R4(config-if)#end R4# R4# R4# *Oct 24 21:09:38.542: %RITE-5-DEACTIVATE: Deactivated IP traffic export on interface GigabitEthernet0/0 |
Following the RITE configuration, the show ip traffic export [interface <name>] command can be used to view or validate the RITE configuration parameters:
| R4#show ip traffic-export interface gigabitethernet 0/0 Router IP Traffic Export Parameters Monitored Interface GigabitEthernet0/0 Export Interface GigabitEthernet0/1 Destination MAC address 1234.abcd.5678 bi-directional traffic export is on Output IP Traffic Export Information Packets/Bytes Exported 7/684 Packets Dropped 72 Sampling Rate one-in-every 10 packets No Access List configured Input IP Traffic Export Information Packets/Bytes Exported 10/964 Packets Dropped 98 Sampling Rate one-in-every 10 packets No Access List configured Profile TSHOOT is Active |
And finally, begin the traffic capture using the traffic-capture interface <name> startcommand as follows:
| R4#traffic-export interface gigabitethernet0/0 start R4# *Oct 24 21:40:29.662: %RITE-5-CAPTURE_START: Started IP traffic capture for interface GigabitEthernet0/0 |
After you have completed the traffic capture, stop the capture using the traffic-capture interface <name> stop command as follows:
| R4#traffic-export interface gigabitethernet0/0 stop R4# R4# *Oct 24 21:45:52.878: %RITE-5-CAPTURE_STOP: Stopped IP traffic capture for interface GigabitEthernet0/0 |
As was previously stated, the IP traffic export feature provides the capability to also capture IP packets in local router memory, and then dump this data to a file on an external device, such as flash memory. The configuration of this capability is follows the same basic steps as that used when exporting the captured traffic to a device off the router interface with some subtle differences. The router configuration steps for local capture are listed and described below:
- Configure a traffic export profile using the ip traffic-export profile <name> mode capture global configuration command
- Specify the length of the packet in capture mode using the length <size> RITE configuration command. Valid options are 128, 256, and 512 bytes
- Apply the traffic export profile to an interface using the ip traffic-export apply <name> size <size> interface configuration command. The size <size> option specifies the size of the buffer, in bytes
- Begin the IP traffic capture using the traffic-export interface <name> start privileged exec command. You can also stop the traffic capture using the traffic-export interface <name> stop privileged exec command. Additional options that can be specified include the traffic-export interface <name> clear privileged exec command which clears the buffer, and the traffic-export interface <name> copy <destination> command which can be used to copy the traffic capture to a TFTP server, Flash memory or an onboard USB device:
As is the case with configuring a traffic capture that will be sent to a specified device, there are also additional options when configuring capture mode (local buffer) traffic captures. These additional options are listed and described in the following section:
- Optionally, you can configure the router to capture bidirectional packets using thebidirectional RITE configuration command
- Optionally, you can configure filtering for incoming traffic using the incoming [access-list <standard | extended | named> | sample one-in-every <packet-number>] RITE configuration command. Inbound filtering is enabled by default after you create the RITE profile
- And finally, you can also optionally filter outgoing traffic using the outgoing [access-list <standard | extended | named> | sample one-in-every <packet-number>] RITE configuration command
The following example illustrates how to configure local IP packet capture on the router. The capture is configured to filter packets referencing an extended ACL and will be applied inbound on the GigabitEthernet0/0 interface. The configuration specifies a packet length of 512 bytes and the local buffer is configured with a size of 1024 bytes:
| R4(config)#ip traffic-export profile TSHOOT mode capture R4(conf-rite)#length 512 R4(conf-rite)#incoming access-list RITE-ACL R4(conf-rite)#exit R4(config)#interface gigabitethernet 0/0 R4(config-if)#ip traffic-export apply TSHOOT size 1024 R4(config-if)#exit R4(config)#ip access-list extended RITE-ACL R4(config-ext-nacl)#permit icmp any any R4(config-ext-nacl)#end |
Following the configuration, the show ip traffic export [interface] command can be used to verify the local traffic capture configuration parameters as follows:
| R4#show ip traffic-export gigabitethernet0/0 Router IP Traffic Export Parameters Monitored Interface: GigabitEthernet0/0 Limit capture length of packet to 512 bytes. bi-directional traffic capture is off Input IP Traffic Capture Information Packets/Bytes Captured 0/0 Packets Dropped 502 Sampling Rate one-in-every 1 packets Access List RITE-ACL [named extended IP] IP Traffic Capture Buffer Information Defined Buffer Size 1024 bytes Capture Buffer Size 1024 bytes Capture Buffer Used 24 bytes Capture Buffer Free 1000 bytes Profile TSHOOT capture state: Active |
After the traffic capture has been configured, the traffic-capture interface <name> startcommand should be used to begin the traffic capture as follows:
| R4#traffic-export interface gigabitethernet 0/0 start R4# *Oct 24 21:40:29.662: %RITE-5-CAPTURE_START: Started IP traffic capture for interface GigabitEthernet0/0 |
After you have completed the traffic capture, stop the capture using the traffic-capture interface <name> stop command as follows:
| R4#traffic-export interface gigabitethernet 0/0 stop R4# R4# *Oct 24 21:45:52.878: %RITE-5-CAPTURE_STOP: Stopped IP traffic capture for interface GigabitEthernet0/0 |
And finally, the traffic-capture interface <name> copy command can be used to export the traffic capture information to an external location such as a TFTP server, Flash or even an onboard USB device. The following example illustrates how to export the traffic capture to a TFTP server with the IP address 150.1.1.254. The file will be saved on the TFTP server with the name r4-traffic-capture:
| R4#traffic-export interface gigabitethernet0/0 copy tftp: Address or name of remote host []? 150.1.1.254 Capture buffer filename []? r4-traffic-capture Copying capture buffer to tftp://150.1.1.254/r4-traffic-capture !! |
Before implementing RITE in a production environment, keep in mind that a delay is incurred on the outbound interface when packets are captured and transmitted across the interface. Performance delays increase with the increased number of interfaces that are monitored and the increased number of destination hosts. And finally, keep the following restrictions in mind when configuring or enabling the Router IP Traffic Export feature:
- The MAC address of the device that is receiving the exported traffic must be on the same VLAN or directly connected to one of the router interfaces. You can use the show arp orshow ip arp command to determine the MAC address of any device that is directly connected to an interface
- The outgoing interface for exported traffic must be Ethernet (10/100/1000). However, the incoming or monitored traffic can traverse any interface
On Cisco IOS distributed router platforms, such as the Cisco 7600 series routers, as well as on Cisco IOS Catalyst switches, the Switched Port Analyzer (SPAN) feature is used to capture packets instead. There are three variations of SPAN, which include the local SPAN feature, Remote SPAN (RSPAN) and Encapsulated RSPAN (ERSPAN).
The local SPAN feature, commonly just simply referred to as SPAN, copies traffic from one or more CPUs, one or more ports, one or more Etherchannels, or one or more VLANs, and sends the copied traffic to one or more destinations for analysis by a network analyzer such as a Switch Probe device or other Remote Monitoring (RMON) probe. Traffic can also be sent to the processor for packet capture by the Mini Protocol Analyzer.
While SPAN does not affect the switching of traffic on sources, it is important to remember that the SPAN-generated copies of traffic compete with user traffic for switch resources. Local SPAN sessions are comprised of an association of source ports and source VLANs with one or more destinations. Each local SPAN session can have either ports or VLANs as sources, but not both. Local SPAN sessions are configured on a single switch. When configuring SPAN, the following restrictions apply when specifying ports as the source:
- The port can be any port type, such as Etherchannel, FastEthernet, or GigabitEthernet
- The same local port can be monitored in multiple SPAN sessions
- The local SPAN source port cannot be configured as a destination port
- Each source port can be configured with a direction (ingress, egress, or both) to monitor
- Source ports can be in the same or different VLANs
When configuring a VLAN as the SPAN source, the following restrictions apply:
- On a given port, only traffic on the monitored VLAN is sent to the destination port
- All active ports in the source VLAN are included as source ports
- Destination ports that belong to the source VLAN are excluded from the source list
- Removed or added ports in a VLAN are removed or added to the session
- You can monitor only Ethernet VLANs
- You cannot use filter VLANs in the same local SPAN session with VLAN sources
And finally, the following restrictions apply to the SPAN destination ports:
- The destination port must reside on the same physical single switch as the source port
- The destination port can be any Ethernet physical port
- The destination port can participate in only one SPAN session at a time
- The destination port cannot be a source port
- The destination port cannot be an Etherchannel group
- If the destination port resides in an Etherchannel group, it is removed from the group
- The destination port will not transmit traffic unless learning is enabled
- The destination port line protocol will show a state of up/down by design
- If ingress forwarding is enabled, the destination port forwards traffic at Layer 2
- A destination port does not participate in spanning tree while the SPAN session is active
- When it is a destination port, it does not participate in any of the Layer 2 protocols
- If the port belongs to a source VLAN, it is excluded from the source and not monitored
In Cisco IOS Catalyst switches, local SPAN source is configured using the monitor session <session_number> source [[single_interface | interface_list | interface_range | mixed_interface_list | single_vlan | vlan_list | vlan_range | mixed_vlan_list} [rx | tx | both]] global configuration command. Keep in mind that the options available will vary depending on the switch platform.
The local SPAN destination is configured using the monitor session <session_number> destination [single_interface | interface_list | interface_range | mixed_interface_list]global configuration command.
The following configuration example illustrates how to configure local SPAN on the switch to copy inbound and outbound traffic on FastEthernet0/1 and send this traffic to interface FastEthernet0/2. It is assumed a monitoring device is connected to the FastEthernet0/2 interface:
| Sw1#configure terminal Enter configuration commands, one per line. End with CNTL/Z. Sw1(config)#monitor session 1 source interface fa 0/1 both Sw1(config)#monitor session 1 destination interface fa 0/2 Sw1(config)#end |
Following this implementation, use the show monitor session [<session | all] detailcommand to verify the local SPAN configuration:
| Sw1#show monitor session 1 Session 1 ——— Type : Local Session Source Ports : Both : Fa0/1 Destination Ports : Fa0/2 Encapsulation: Native Ingress: Disabled |
The detail keyword can be appended to view detailed information as follows:
| Sw1#show monitor session 1 detail Session 1 ——— Type : Local Session Source Ports : RX Only : None TX Only : None Both : Fa0/1 Source VLANs : RX Only : None TX Only : None Both : None Source RSPAN VLAN : None Destination Ports : Fa0/2 Encapsulation: Native Ingress: Disabled Reflector Port : None Filter VLANs : None Dest RSPAN VLAN : None |
Figure 2-4 illustrates a sample packet capture, using Wireshark, based on the configuration that was applied to the switch in the previous configuration example:
Fig. 2-4. Sample Packet Capture from a Local SPAN Session
Unlike local SPAN, Remote SPAN supports source ports and VLANs, as well as destinations on different switches, allowing you to perform remote monitoring of multiple switches across your network. RSPAN does this by using a Layer 2 VLAN to carry SPAN traffic between switches. RSPAN configuration is therefore comprised of an RSPAN source session, an RSPAN destination session, and an RSPAN VLAN. RSPAN source and destination sessions can also be configured on different switches.
An RSPAN source session can have either ports or VLANs as sources, but not both. The RSPAN source session copies traffic from the source ports or source VLANs and switches the traffic over the RSPAN VLAN to the RSPAN destination. The RSPAN destination session switches the traffic to the destinations. In addition to source ports and VLANs as well as destination ports, RSPAN also introduces a new port type referred to as a reflector port. The reflector port is simply a port that copies packets onto an RSPAN VLAN. All reflector ports have the following characteristics and restrictions:
- A reflector port is a port set to loopback
- A reflector port cannot be an Etherchannel group
- A reflector port does not trunk
- A reflector port cannot do protocol filtering
- If a port assigned to an Etherchannel is specified, it is removed from the Etherchannel
- A reflector port cannot be a SPAN source or destination port
- A reflector port cannot be a reflector port for more than one RSPAN session
- A reflector port is invisible to all VLANs
- The native VLAN for looped-back traffic on a reflector port is the RSPAN VLAN
- The reflector port loops back untagged traffic to the switch
- Spanning tree is automatically disabled on a reflector port.
- A reflector port receives copies of sent and received traffic for all monitored source ports
The configuration of RSPAN is performed in two steps. The first step entails the configuration of the RSPAN VLAN using the remote-span VLAN configuration command. The following configuration example illustrates how to configure a VLAN as an RSPAN VLAN:
| Sw1(config)#vlan 123 Sw1(config-vlan)#name RSPAN-VLAN Sw1(config-vlan)#remote-span Sw1(config-vlan)#exit Sw1(config)#exit Sw1# |
This configuration can then be validated using the show vlan id command as follows:
| Sw1#show vlan id 123VLAN Name Status Ports —- ——————————– ——— —————————- 123 RSPAN-VLAN activeVLAN Type SAID MTU Parent RingNo BridgeNo Stp BrdgMode Trans1 Trans2 —- —– ———- —– —— —— ——– —- ——– —— —- 123 enet 100123 1500 – – – – – 0 0Remote SPAN VLAN —————- EnabledPrimary Secondary Type Ports ——- ——— —————– —————————————- |
The second step following the RSPAN VLAN configuration is to configure the RSPAN sessions. This can be performed in SPAN configuration mode or in global configuration mode. The following section shows how to configure source RSPAN session in SPAN configuration mode:
- Configure the RSPAN source session using the monitor session <session> type rspan-source global configuration command
- Associate the RSPAN source session number with the CPU, source ports, or VLANs, and select the traffic direction to be monitored using the source [[cpu [rp | sp]] |<interface> | <interface list> | <interface range> | <vlan> | <vlan list> | <vlan range>] [rx | tx | both] RSPAN source session configuration command
- Associate the RSPAN source session number with the RSPAN VLAN using the destination remote vlan <RSPAN-VLAN> RSPAN source session configuration command
The following section describes how to configure the destination session in RSPAN destination sessions in SPAN configuration mode:
- Configure the RSPAN destination session using the monitor session <session> type rspan-destination global configuration command
- Associate the the RSPAN destination session number with the RSPAN VLAN using thesource remote vlan <RSPAN-VLAN> RSPAN destination session configuration command
- Associate the RSPAN destination session number with the destinations using thedestination [<interface>| <interface list | <interface range> [ingress [learning]]RSPAN destination session configuration command
The following configuration example illustrates how to configure an RSPAN session between two switches. It should be assumed that these switches have a truck connection configured between them. The RSPAN configuration will copy traffic from port GigabitEthernet1/1 on switch 1 to port GigabitEthernet1/1 on switch 2. VLAN 123 will be used for RSPAN. The configuration on the switch 1 (Sw1), which is the RSPAN source, is implemented as follows:
| Sw1(config)#vtp domain H2N-TSHOOT Sw1(config)#vtp mode transparent Sw1(config)#vlan 123 Sw1(config-vlan)#name RSPAN-VLAN Sw1(config-vlan)#remote-span Sw1(config-vlan)#exit Sw1(config)#exit Sw1(config)#monitor session 1 type rspan-source Sw1(config-mon-rspan-src)#source interface gigabitethernet 1/1 Sw1(config-mon-rspan-src)#destination remote vlan 2 Sw1(config-mon-rspan-src)#end |
The configuration on switch 2 (Sw2), the RSPAN destination, is implemented as follows:
| Sw2(config)#vtp domain H2N-TSHOOT Sw2(config)#vtp mode transparent Sw2(config)#vlan 123 Sw2(config-vlan)#name RSPAN-VLAN Sw2(config-vlan)#remote-span Sw2(config-vlan)#exit Sw2(config)#exit Sw2(config)#monitor session 1 type rspan-destination Sw2(config-mon-rspan-dst)#source remote vlan 2 Sw2(config-mon-rspan-dst)#destination interface gigabitethernet 1/1 Sw2(config-mon-rspan-dst)#end |
Following the RSPAN configuration, you can use the show monitor session <number>command to validate the configuration. Following is the output of this command on Sw1:
| Sw1#show monitor session 1 Session 1 ——— Type : Remote Source Session Source Ports : Both : Gi1/1 Dest RSPAN VLAN : 2 |
The output of the same command on Sw2 shows the following:
| Sw2#show monitor session 1 Session 1 ——— Type : Remote Destination Session Source RSPAN VLAN : 2 Destination Ports : Gi1/1 Encapsulation : Native Ingress : Disabled |
As was previously stated, the second option is to configure RSPAN in global configuration mode. The following section describes the sequence of steps required to configure RSPAN source sessions in global configuration mode:
- Configure the RSPAN source session number with the source ports or VLANs, and selects the traffic direction to be monitored using the monitor session <session> source <interface> | <interface list> |<interface range> | <vlan> | <vlan list>| <vlan range>] [rx | tx | both] global configuration command
- Associate the RSPAN source session number with the RSPAN VLAN using the monitor session <session> destination remote vlan <RSPAN-VLAN> global configuration command
The following section describes how to configure RSPAN destination sessions in global configuration mode:
- Configure the RSPAN destination session number with the RSPAN VLAN using the monitor session <session> source remote vlan <RSPAN-VLAN> global configuration command
- Associate the RSPAN destination session number with the RSPAN VLAN using the monitor session <session> destination <interface> | <interface list>| <interface range>| [ingress [learning]] global configuration command
The following configuration illustrates how to configure RSPAN in global configuration mode using VLAN 123 as the RSPAN VLAN. This configuration assumes that a trunk has been configured between the two switches. RSPAN is configured to copy traffic received from the GigabitEthernet1/1 port on switch 1, while switch 2 forwards this copied traffic to its local GigabitEthernet1/1 port. The configuration on the switch 1 (Sw1), which is the RSPAN source, is implemented as follows:
| Sw1(config)#vtp domain H2N-TSHOOT Sw1(config)#vtp mode transparent Sw1(config)#vlan 123 Sw1(config-vlan)#name RSPAN-VLAN Sw1(config-vlan)#remote-span Sw1(config-vlan)#exit Sw1(config)#exit Sw1(config)#monitor session 1 source interface gigabitethernet 1/1 Sw1(config)#monitor session 1 destination remote vlan 2 Sw1(config)#end |
The configuration on switch 2 (Sw2), the RSPAN destination, is implemented as follows:
| Sw2(config)#vtp domain H2N-TSHOOT Sw2(config)#vtp mode transparent Sw2(config)#vlan 123 Sw2(config-vlan)#name RSPAN-VLAN Sw2(config-vlan)#remote-span Sw2(config-vlan)#exit Sw2(config)#exit Sw2(config)#monitor session 1 source remote vlan 2 Sw2(config)#monitor session 1 destination interface gigabitethernet 1/1 Sw2(config)#end |
As stated in the previous configuration example, the show monitor session <number>command can be used to validate this configuration. Following is the output of this command on switch 1 (Sw1):
| Sw1#show monitor session 1 Session 1 ——— Type : Remote Source Session Source Ports : Both : Gi1/1 Dest RSPAN VLAN : 2 |
NOTE: When using the show monitor session <number> command, append the detailkeyword to this command to print detailed information as illustrated below:
| Sw1# show monitor session 1 detail Session 1 ———— Type : Remote Source Session Source Ports: RX Only: Gi1/1 TX Only: None Both: None Source VLANs: RX Only: None TX Only: None Both: None Source RSPAN VLAN: None Destination Ports: None Filter VLANs: None Dest RSPAN VLAN: 2 |
The output of the show monitor session command on Sw2 shows the following:
| Sw2#show monitor session 1 Session 1 ——— Type : Remote Destination Session Source RSPAN VLAN : 2 Destination Ports : Gi1/1 Encapsulation : Native Ingress : Disabled |
And finally, the last SPAN variant, Encapsulated RSPAN is somewhat similar to RSPAN in that it supports source ports and VLANs, and destinations on different switches; however, unlike RSPAN that uses a Layer 2 VLAN for the SPAN traffic, ERSPAN uses a GRE tunnel to carry traffic between switches. This means that ERSPAN can be configured across IP networks, thus providing far greater monitoring capabilities on the network.
ERSPAN consists of an ERSPAN source session, a routable ERSPAN GRE-encapsulated traffic, and an ERSPAN destination session. In a manner similar to RSPAN, ERSPAN source and destination sessions can be configured on different switches. Additionally, like RSPAN, each ERSPAN source session can have either ports or VLANs as sources, but not both.
NOTE: The configuration of ERSPAN is beyond the scope of the TSHOOT certification exam and will not be illustrated or described in any further detail in this guide.