Arista EOS Central - Category

Selective Packet Truncation in Tap Aggregation

Posted on March 16, 2020 by Edmund | 961 Views

Selective Packet Truncation in Tap Aggregation Packet Truncation in tap aggregation mode allows tapped traffic to be truncated to a smaller size before being transmitted. It can be used to reduce the amount of traffic received by analysis devices, if only the headers are to be analyzed while the payload of the packets is irrelevant or unwanted for practical or legal reasons. Truncation is applied either at the tap or tool port. This means that all traffic either arriving from a source or sent to a tool is subject to the truncation setting. In practice, it may be desirable to...
Continue reading →

Achieving Optimal Timestamp Accuracy on 7150 Platforms

Posted on June 8, 2020 by jp | 885 Views

Background The launch of the Arista 7150S in 2012 delivered the industry’s first product to offer high speed networking with high granularity packet time stamping in an Ethernet switch/router platform. This article will review how time stamping has evolved since. Arista first conceived of the capability to leverage the 7150S to intersect with an emerging network monitoring market requirement that would improve the ability to capture the proper order of traffic captured by network analysis tools over the out of band (OOB) tap aggregation (aka network packet broker) infrastructure. Applying timestamps to packets at the network ingress ports of the...
Continue reading →

Forward TCPDump to Wireshark

Posted on May 1, 2020 by Jonathan Smith | 2101 Views

Description Using TCPDump on an Arista switch is an impressive feature and can help with troubleshooting, security concerns, and much more. But if you need to watch a packet capture live using TCPDump can be tricky since you can’t use display filters, trace a packet, and use many different tools that are found in Wireshark. In this article, we will go over how we can forward our live TCPDump session to our local host computer running Wireshark. Please refer to this article to learn the basics of TCPDump on an Arista switch. Using tcpdump for Troubleshooting Platform Compatibility All Arista...
Continue reading →

Tap Aggregation PTP Sync & Transparent Clock (TC) PTP Multicast Configuration

Posted on November 11, 2019 by Nadeem Khan | 1164 Views

Description This article covers the configuration required to run the PTP TC with multicast transport environment, and Tap Aggregation DUT time sync with PTP GM. Platform Compatibility DCS-7020 DCS-7280SE/ DCS-7500E DCS-7280R/RX DCS-7500R/RX DCS-7150 DCS-7050X/XX DCS-7060X/XX Topology Diagrams Configuration In this PTP implementation example, the NY1 will act as BC and NY4 as GM. Both are configured as PTP BC clocks but NY4 due to its lower Priority1 value will win the BCMA election and becomes the master. The NY2 and NY3 are configured as E2E TC clocks and will require PIM to forward the PTP messages generated by...
Continue reading →

How to source Splunk Forwarder traffic from a Loopback Interface

Posted on February 20, 2019 by Steven King | 989 Views

The diagram below describes the use case: SWITCH1 has a Splunk Forwarder that needs to send traffic to SPLUNK at 10.0.0.10. SWITCH2 is originating a default route via BGP. SWITCH1 is only advertising its Loopback0 interface into BGP. The Splunk Forwarder CLI configuration does not currently support specifying a source interface, and in this scenario this is a problem because SWITCH3 has no route to reach 192.168.255.0, which would be the source IP for any traffic that SWITCH1 sends to SPLUNK. SWITCH3 does however have a route to SWITCH1’s Loopback0 interface. We verify this by pinging SPLUNK from SWITCH1 and...
Continue reading →

40G TapAgg BiDi Design

Posted on June 18, 2018 by Nadeem Khan | 1534 Views

Arista QSFP BiDi optics allow both transmit and receive signals, to travel on the same fiber slice. The QSFP BiDi design provides 40Gbps (20Gbps egress & 20Gbps ingress on each fiber slice) bandwidth using the duplex MMF (OM3, & OM4) cable. This way one can leverage the existing cabling infrastructure to upgrade BW from 10Gbps to 40Gbps ( see diagram 1). The BiDi optics provides a number of benefits and some are listed below: ▪ Fiber replacement not required when moving from 10Gbps to 40Gbps ▪ Lower CAPEX as 75% less fiber comparing parallel cable (40G SR4) ▪ Interoperable with Industry standard...
Continue reading →

Tap Aggregration Tip: Popping MPLS tags for Untagged or VLAN based Tools

Posted on May 12, 2018 by John Frame | 1245 Views

In Tap Aggregation scenarios common in WAN and Service Provider environments, MPLS tags are present. Many of the analysis tools do not understand these tags and so the Arista DANZ feature set allows for these to be removed. This functionality has been around since 4.15.0F however initially had the limitation that the traffic would always be sent out the Tool port with a VLAN tag. However, some tools not only do not understand MPLS, but also VLAN tags, so this tip describes how to deal with both 802.1q and untagged scenarios. Step 1: Configure MPLS pop/strip on the Tap port:...
Continue reading →

Analyzing Packet Header Timestamps in Wireshark

Posted on April 14, 2017 by Edmund | 1023 Views

Arista Packet Header Timestamps EOS 4.18.1F added header time stamping of all packets received on any tap interface in Tap Aggregation mode on the 7500/7280E and 7500/7280R. Full details on the implementation can be found in the feature’s TOI: https://eos.arista.com/eos-4-18-1f/tap-aggregation-ingress-header-time-stamping/ Since the timestamp is a new ethernet header, Wireshark doesn’t yet have a built in dissector for the protocol. We can write a dissector in Lua to do this for us. Header Format First we need to understand the new header format. The timestamp header is a new Ethernet/L2 header consisting of the Arista EtherType (0xD28B), a two-byte protocol subtype of 0x1, a...
Continue reading →

Understanding Deduplication in Tap Aggregation (NPB)

Posted on October 26, 2015 by Alexis Dacquay | 10054 Views

1) What is deduplication ? Deduplication in the context of packet broker networks (Tap Aggregation) is the ability to detect duplicates of a packet, allowing only the first packet and dropping other iterations of the same packet. 2) Hardware impacts the Deduplication performance Deduplication, like many features, requires certain hardware characteristics to be supported by the silicon (network processor), which is the foundation of hardware packet processing and forwarding in networking/Ethernet equipment. It allows matching packet, manipulating, and making forwarding decisions in hardware. 2.1) Processing performance The Arista switches are based on high performance network processors of different...
Continue reading →

Latency Analyzer (LANZ) Architectures and Configuration

Posted on March 11, 2015 by josh | 26948 Views

Introduction Arista Latency Analyzer, or LANZ, is a technology that tracks and logs buffer congestion and latency in real time. The visibility provided by LANZ of network hot-spots and microburst oversubscription gives the network operator greater insight into when problems are occurring on the network and why. With LANZ you will know when congestion happened, track the sources of congestion, and be able to export real-time events to external applications. LANZ also shows the effect of packet buffering on an application as well as monitors and records packet drops during network congestion. It is an invaluable tool which allows...
Continue reading →

sFlow Generation for Legacy Networks with Tap Aggregation (NPB / Matrix switch)

Posted on February 24, 2015 by Alexis Dacquay | 13714 Views

sFlow is a standard hadware sampling available on all the Arista platforms, providing rich statistical information on all ports. sFlow is available in Tap Aggregation mode, allowing additional use cases of Tap Aggregation than traffic analysis on analyzer tools: Retro-fitting sFlow to legacy infrastructure Distributed analysis This article focuses on Retro-fitting sFlow to legacy infrastructure. 1) sFlow vs Netflow sFlow is a sampling mechanism implemented in hardware: Widely available on non-legacy platforms, and widely supported on collectors/monitoring software sFlow requires minimal local processing which contrast with Netflow that is very CPU-intensive, making Netflow poorly suitable for any high performance...
Continue reading →

DANZ – Tap Aggregation optics / transceivers selection

Posted on February 23, 2015 by Alexis Dacquay | 11441 Views

This articles clarifies certain criteria that are important to consider in the design of a Network Packet Broker (NPB) aggregating traffic from various sources. For distance reasons, the main type of media used in tap aggregation is optical (multimode or single mode), therefore this article mainly focuses on these media. 1) Understanding Optical Budgets Multiple factors contribute to the degradation of optical signals Fiber attenuation Insertion loss (e.g. connectors, patch panels and splices) Fiber type mismatch (e.g. connecting 50/125MMF to 62.5/125MMF) Over-bending of fibre plant Intermediate passive devices (e.g. taps, attenuators or mode filters) Media Type Approximate Loss...
Continue reading →

DANZ Tap Aggregation – Basic settings – Before you start

Posted on February 23, 2015 by Alexis Dacquay | 9443 Views

Several Arista switches support DANZ feature set for Tap Aggregation. The tap aggregation mode is a mere configuration (1-2 lines) that transform a high performance L2/L3 switch into a Tap Aggregator (NPB). This mode require certain considerations: 1) Tap aggregation – How to selecting the exclusive mode That tap aggregation mode is exclusive to part of a switch of the whole switch. Parts of the switch that are excluded from the Tap Aggregation mode can work either in fully L2/L3 forwarding mode (normal switching mode), or in simple hub mode. The options available vary per platforms, as per the below list....
Continue reading →

Deep Packet Inspection with Tap Aggregation

Posted on December 24, 2014 by Eric | 10330 Views

Introduction In this article we will focus on the Deep Packet Inspection access list enhancements available in Tap Aggregation Exclusive mode on the Arista 7150 series switches. Deep Packet Inspection (DPI) is an Access List enhancement that was introduced in EOS 4.14.0.F. This feature allows the administrator to inspect and match additional bytes in the packet header after the Layer 2, Layer 3 or Layer 4 header. DPI was designed to be utilized while in Tap Aggregation exclusive mode. Typical Use cases for DPI are: Identifying custom fields in Day zero attacks SLA Enforcement via identifying illegal content Behavioural targeting...
Continue reading →

DANZ Table of Contents

Posted on December 23, 2014 by josh | 9234 Views

Tap Aggregation Introduction to Tap Aggregation Basic Use of Aggregation Groups Tab Aggregation Basic Settings Before You Start Filtering with Port ACLs Tap Aggregation VLAN List Filtering Tap Aggregation Traffic Steering Deep Packet Inspection Truncation on Tap and Tool Ports LLDP on Tap Ports Common Challenges with TapAgg TapAgg Glossary Advanced Mirroring Introduction to Port Mirroring Filtering with Port ACLs Latency Analyzer (LANZ) LANZ Architectures and Configuration LANZ Buffer Tuning Timestamping TimeStamping on the 7150 Timestamping Deep Dive and Frequent Questions Optics Tap Aggregation Optics Selection

Data Analyzer (DANZ) Glossary

Posted on December 23, 2014 by josh | 9738 Views

Access List (ACL) The switch configuration used for the purpose of filtering Layer 2, Layer 3, or Layer 4 traffic. See Filtering with Port ACLs Advanced Mirroring An Arista feature set which includes support for filtered, multi-destination mirroring, mirroring to EOS of data plane traffic, advanced load-sharing, and packet truncation. Aggregation Group A configuration or grouping of Tap and Tool ports together where traffic from all Tap ports in a group will be replicated to all Tool ports in the same group. A tool port can be a member of multiple aggregation groups whereas a tap port is allowed...
Continue reading →

DANZ Tap Aggregation – Filtering on inner Q-in-Q header, and stripping outer header – At the same time

Posted on December 16, 2014 by Alexis Dacquay | 7111 Views

This article documents the ability, for the Arista 7150S in Tap Aggregation mode, to selectively filter on inner Q-in-Q header, and also strip the outer header on egress, effectively allowing a granular selection of what Q-tagged traffic tools will be receiving. Let’s take as traffic example some Q-in-Q traffic: Outer Q-header (Eth-type 0x88a8) – STAG – VLAN ID = 100 Inner Q-header (Eth-type 0x8100) – CTAG – VLAN ID = 101, 102 Packet capture example for this Q-in-Q traffic: 7150S(config)#bash sudo tcpdump -nni mirror0 [...] 22:23:44.040896 00:ab:00:00:02:23 > 00:1c:73:86:00:69, ethertype 802.1Q-QinQ (0x88a8), length 1020: vlan 100, p...
Continue reading →

Basic Use of Aggregation Groups

Posted on December 10, 2014 by coreyhines | 6791 Views

Introduction Aggregation groups provide a means of grouping tool ports to simplify the mapping of a tap port to multiple tools and allow grouping of alike applications. In current releases, each tap port can only be bound to one default aggregation group at any time. A tool port however, can simultaneously be a member of multiple aggregation groups. This is important as it allows multiple tools or tool servers to receive any of the multiple traffic flows input to the tap ports. The Tap Aggregation operator can for example have an IDS/IPS tool receiving the same traffic as an application...
Continue reading →

Common challenges with TAP aggregation

Posted on December 10, 2014 by jp | 8364 Views

Introduction Capturing raw network packet data, whether it be from a mirror port or through an aggregation infrastructure, is often perceived to be a complex task. In reality, most of the anomalies or limitations faced by those starting out with capture have simple explanations and are usually not due to problems with the source devices but instead the capturing tool. This article provides a brief of commonly reported issues and some suggested avenues of investigation. Timestamping Timestamps missing or corrupt Check timestamping is configured correctly to match the hosts’ expectations (i.e. is the host looking in the right place for...
Continue reading →

Truncation on Tap and Tool Ports

Posted on December 10, 2014 by coreyhines | 7555 Views

Introduction EOS supports truncation on ingress and egress. In this article we will focus on how it can be applied in tap aggregation exclusive mode, on the Arista 7150 line of switches. Please refer to the supported features matrix for other hardware platforms. Truncation is the ability to remove unwanted or unneeded bytes from the packet at a configurable or fixed starting byte position, it may also be referred to as ‘Packet Slicing’. This is useful in situations where the data of interest is contained within the headers or early in the packet payload. It can be used to remove...
Continue reading →

Category : DANZ