• Author : edmund

 
 

Selective Packet Truncation in Tap Aggregation

Selective Packet Truncation in Tap Aggregation Packet Truncation in tap aggregation mode allows tapped traffic to be truncated to a smaller size before being transmitted. It can be used to reduce the amount of traffic received by analysis devices, if only the headers are to be analyzed while the payload of the packets is irrelevant or unwanted for practical or legal reasons. Truncation is applied either at the tap or tool port. This means that all traffic either arriving from a source or sent to a tool is subject to the truncation setting. In practice, it may be desirable to...
Continue reading →

Analyzing Packet Header Timestamps in Wireshark

Arista Packet Header Timestamps EOS 4.18.1F added header time stamping of all packets received on any tap interface in Tap Aggregation mode on the 7500/7280E and 7500/7280R. Full details on the implementation can be found in the feature’s TOI: https://eos.arista.com/eos-4-18-1f/tap-aggregation-ingress-header-time-stamping/ Since the timestamp is a new ethernet header, Wireshark doesn’t yet have a built in dissector for the protocol. We can write a dissector in Lua to do this for us. Header Format First we need to understand the new header format. The timestamp header is a new Ethernet/L2 header consisting of the Arista EtherType (0xD28B), a two-byte protocol subtype of 0x1, a...
Continue reading →

Automate switch port configuration with EosSdk

Switch migrations are part of life in any datacenter, whether to add capacity with a larger system or new capabilities with a later product generation. There are two parts to this task – loading a configuration and the “rack and stack” of physical installation and cabling. Configuring the new new leaf switch is greatly simplified by tools such as ZTPServer. You can even use LLDP to verify that you’ve cabled the switch to its neighbors correctly. However, when it comes to plugging in servers, you still depend on a very manual process. This can be straight forward when you’ve a single VLAN...
Continue reading →

Follow

Get every new post on this blog delivered to your Inbox.

Join other followers: