Posted on March 26, 2015 10:51 am
 |  Asked by David Shang
 |  556 views
RESOLVED
-1
0
Print Friendly, PDF & Email

When using the mirroring on the 7150 series to send a copy of the data plane traffic to the CPU, I have a problem to get the 32-bit timestamp at the end of the payload using tcpdump or libpcap. Sometimes I can get it but sometimes the timestamp (at the location of FCS) is stripped off in the “captured length” returned by the pcap. Do you have any suggestion solve this issue?

-1
Posted by Andrei Dvornic
Answered on March 26, 2015 11:00 am

Can you share the details of what commands you are running exactly and the results seen? I suspect you see both:

  • mirrored timestamped data plane traffic (timestamping happens on ingress, in hardware(ASIC))
  • control-plane traffic (sourced on the switch or coming via the management interface), which is not timestamped

Is this the case?

 

Post your Answer

You must be logged in to post an answer.