How
to activate and use built-in packet capture on HPE Comware switches
In every
firmware upgrade file, you probably found a feature image package:
After
upgrading to the required image version, login into the switch and run the
following command:
install
activate feature flash:/5130ei-cmw710-packet-capture-r3208p10.bin slot 1
|
You should
see the following output:
<HPE-5130-EI>install
activate feature flash:/5130ei-cmw710-packet-capture-r3208p10.bin slot 1
Verifying the
file flash:/5130ei-cmw710-packet-capture-r3208p10.bin on slot 1.....Done.
Identifying
the upgrade methods....Done.
Upgrade
summary according to following table:
flash:/5130ei-cmw710-packet-capture-r3208p10.bin
Running Version New Version
None Release 3208P10
Slot Upgrade Way
1 Service
Upgrade
Upgrading
software images to compatible versions. Continue? [Y/N]:y
This operation
might take several minutes, please wait..................Done.
|
Then
do install commit:
<HPE-5130-EI>install
commit
This operation
will take several minutes, please wait........................Done.
|
Check
that the feature package is activated:
<HPE-5130-EI>show
install active
Active
packages on slot 1:
flash:/5130ei-cmw710-boot-r3208p10.bin
flash:/5130ei-cmw710-system-r3208p10.bin
flash:/5130ei-cmw710-packet-capture-r3208p10.bin
|
Then
reboot the switch:
<HPE-5130-EI>reboot
Start to check
configuration with next startup configuration file, please wait.........DONE!
This command
will reboot the device. Continue? [Y/N]:y
|
After
the switch reloads, you can start using the built-in packet capture:
<HPE-5130-EI>packet-capture
interface Ten-GigabitEthernet 1/0/52 ?
autostop Specify the autostop criteria
for packet capture
brief Brief information
capture-filter Specify a filter rule for packet
capture
capture-ring-buffer Specify the criteria for saving captured
frames to a
new capture file
display-filter Specify a filter rule for displaying
captured frames
limit-captured-frames Specify the maximum number of captured
frames
limit-frame-size Specify the maximum size of a frame to
be captured
raw Display the packet data
in hexadecimal format
verbose Detailed information
write Specify the directory for
saving captured frames
<cr>
<HPE-5130-EI>packet-capture
interface Ten-GigabitEthernet 1/0/52
|
This comment has been removed by the author.
ReplyDeleteNote that it will only capture packets that are forwarded to the CPU backplane. So you will see things like ARP, PING, Routing, etc. but not Unicast transit traffic. To see that you need to do some qos configuration commands to forward an ACL matching traffic to the management backplane.
ReplyDelete