Posted on May 10, 2014 5:55 am
 |  Asked by Dave Stubbs
Print Friendly, PDF & Email

I have tried tcpdump from both the regular eos cli and also from inside the bash shell.  In both cases, the only traffic I can see is the traffic generated by the switch itself (mostly Rapid STP packets), even though there is a pile of traffic going through the port.  I’m running a 7048T-A with firmware  I’m seeing this same behaviour with both access and trunk ports.

Is there any setting I need to enable so that tcpdump will actually show traffic?



Posted by unknown
Answered on May 10, 2014 6:10 am

Hi Dave,

Tcpdump will only show traffic originated from or destined to the switch (i.e control plane traffic) on the 7048 series switches. We do have a feature referred to as Advanced mirroring which is the ability to use tcpdump to see dataplane traffic however that is available only on the 7150S series switches today. HTH

Marked as spam
Posted by Dave Stubbs
Answered on May 12, 2014 3:22 am

<sigh>  that’s not the thing a first time customer wants to hear.

Posted by Andrei Dvornic
Answered on May 12, 2014 9:02 am

Hi Dave,


I am sorry to hear you are disappointed, but this is how standard tcpdump works. :-)

Let me give you a few more details, in case it makes it a bit more clear: tcpdump is a software tool which runs in EOS and captures all packets which get to the CPU or are originated in the CPU. Unless advanced mirroring features are used (mentioned previously), data plane traffic does NOT reach the CPU (switching/forwarding is done in the ASIC itself). This is different from a server, where all the traffic generally goes straight to the CPU.

With advanced mirroring on the 7150 series, we are able to send a copy of the data plane traffic to the CPU. However, note that the CPU is a limited resource and current CPUs cannot handle very large amounts of data without having an impact on the performance of the switch – this is why we usually rate-limit this kind of traffic to 100Mbps by default.

Marked as spam

Post your Answer

You must be logged in to post an answer.