Cisco的 7600 Packet_capture.pptVIP

Packet Capturing By: wyu Feb, 2006 Agenda Packet Capture/Analysis Tools Most Commonly Used Packet Capture/Analysis Tool General Packet Capture Mode Continuous Packet Capturing Capture all packets that meets the condition that set by users in a fixed packet buffer. Packets are stored in the ring-type buffer and dropped in first-in first-out basis. Depending on the equipment vendor, capturing could stop whenever the packet buffer is full. Packet buffer size can be adjusted by users Triggered Packet Capturing Packet capturing starts only when triggered condition meets. Capture stops after packet buffer is felt Users might be able to set number of packets to be saved before trigger packets occurs Capture Tips Always set good filters Eliminate unwanted packets begin capture and waste buffer memory Narrowed the scope for what packets to look for Be aware of promiscuous mode being set by default, especially in the Ethernet case, it capture everything on the wire. Ensure correct physical layer property setting and L2 Protocol Eliminate the possibility for not being able to capture packets due to CRC or Scrambling incorrectly set Set with correct L2 protocol, it helps the packet analyzer to decode packet with correct packet format as cases like encapsulation PPP/HDLC My favorite capture setup Traffic Source Using 7600 ELAM What’s ELAM ELAM – Embedded Logic Analyzer Module It is a EARL built-in logic analyzer that can be used as a packet capture tool for superman and tycho ASIC’s What can it do and how to use it? How to enable it ? By configuring ‘service internal’. Where can I use it ? On any module that has an EARL7 ASIC complex. A Supervisor 720 or a DFC3 capable card. On which prompt do I start it ? Either RP or SP prompt. How many packets can I capture ? ONE How do I find the packet that I need ? By setting a trigger. How do I find out which ASIC’s are available ? sh platform capture system asic Remember, ELAM only captures on superman and tycho asic! SUP7