Catalyst 4500 Series Switch Software Configuration Guide, IOS XE 3.9.xE and IOS 15.2(5)Ex

Capture Points

A capture point is the central policy definition of the Wireshark feature. The point describes all the characteristics associated with a given instance of Wireshark: what packets to capture, where to capture them from, what to do with the captured packets, and when to stop. Capture points can be modified after creation and do not become active until explicitly activated with a start command. This process is termed activating the capture point or starting the capture point. Capture points are identified by name and may also be manually or automatically deactivated or stopped.

Multiple capture points may be defined and activated simultaneously.

Attachment Points

An attachment point is a point in the logical packet process path associated with a capture point. Consider an attachment point as an attribute of the capture point. Packets that impact an attachment point are tested against the capture point's filters; packets that match are copied and sent to the capture point's associated Wireshark instance. A specific capture point can be associated with multiple attachment points, with limits on mixing attachment points of different types. Some restrictions apply when you specify attachment points of different types. Attachment points are directional (input or output or both) with the exception of the Layer 2 VLAN attachment point, which is always unidirectional.

Filters

Filters are attributes of a capture point that identify and limit the subset of traffic traveling through the attachment point of a capture point, which is copied and passed to Wireshark. To be displayed by Wireshark, a packet must pass through an attachment point, as well as all of the filters associated with the capture point.

A capture point has three types of filters:

• Core system filter—The core system filter is applied by hardware, and its match criteria is limited by hardware. This filter determines whether hardware-forwarded traffic is copied to software for Wireshark purposes.
• Capture filter—The capture filter is applied by Wireshark. The match criteria are more granular than those supported by the core system filter. Packets that pass the core filter but fail the capture filter are still copied and sent to the CPU/software, but are discarded by the Wireshark process. The capture filter syntax matches that of the display filter.

Note Wireshark on the Catalyst 4500 series switch does not use the syntax of the capture filter.

• Display filter—The display filter is applied by Wireshark, and its match criteria are similar to those of the capture filter. Packets that fail the display filter are not displayed.

Core System Filter

You can specify core system filter match criteria by using the class map or ACL, or explicitly by using the CLI.

In some installations, you need to obtain authorization to modify the switch configuration, which can lead to extended delays if the approval process is lengthy. This would limit the ability of network administrators to monitor and analyze traffic. To address this situation, Wireshark supports explicit specification of core system filter match criteria from the EXEC mode CLI. The disadvantage is that the match criteria that you can specify is a limited subset of what class map supports, such as MAC, IP source and destination addresses, ether-type, IP protocol, and TCP/UDP source and destination ports.

If you prefer to use configuration mode, you can define ACLs or have class maps refer capture points to them. Explicit and ACL-based match criteria are used internally to construct class maps and policy maps. These implicitly constructed class maps are not reflected in the switch running-config and are not NVGEN’d.

Note The ACL and class map configuration are part of the system and not aspects of the Wireshark feature.

Capture Filter

The capture filter allows you to direct Wireshark to further filter incoming packets based on various conditions. Wireshark applies the capture filter immediately on receipt of the packet; packets that fail the capture filter are neither stored nor displayed.

A switch receives this parameter and passes it unchanged to Wireshark. Because Wireshark parses the application filter definition, the defining syntax is the one provided by the Wireshark display filter. This syntax and that of standard Cisco IOS differ, which allows you to specify ACL match criteria that cannot be expressed with standard syntax.

Note The capture filter syntax matches that of the Wireshark display filter. The syntax for capture and display filters are identical in the Wireshark implementation on the Catalyst 4500 series switch.

Display Filter

With the display filter, you can direct Wireshark to further narrow the set of packets to display when decoding and displaying from a.pcap file. Because the syntax of the display filter is identical to the capture filter, the display filter is superfluous if a capture filter is also defined.

For more details on the syntax of capture and display filters, go to

http://wiki.wireshark.org/DisplayFilters

Input and Output Classification

There are four classification results for input and output classification. In the input direction, they are ordered role-based, security, QoS, and forwarding override. In the output direction they are ordered forwarding override, role-based, security, and QoS.

On the input side, the Wireshark capture feature is placed in the forwarding override result type, prioritized above the other FO features (such as multicast local source capture, PBR and ingress WCCP). The packets captured by Wireshark are before any redirection by PBR or WCCP. Because security ACLs are applied ahead of FO-related features, packets that are dropped by security ACLs are not captured by Wireshark.

On the output side, the Wireshark capture feature is placed in the forwarding override result type, prioritized below the other FO features (such as egress WCCP). Wireshark captures packets only if the other egress FO features do not apply.

Actions

Wireshark can be invoked on live traffic or on a previously existing.pcap file. When invoked on live traffic, it can perform four types of actions on packets that pass its capture and display filters:

• Captures to buffer in memory to decode and analyze and store
• Stores to a.pcap file
• Decodes and displays
• Stores and displays

When invoked on a.pcap file only, only the decode and display action is applicable.

Storing Captured Packets to Buffer in Memory

Packets can be stored in the capture buffer in memory for subsequent decode, analysis, or storage to a.pcap file.

The capture buffer can be linear or circular mode. In linear mode, new packets are discarded when the buffer is full. In circular mode, if the buffer is full, the oldest packet are discarded to accommodate the new packet. Although the buffer can also be cleared when needed, this mode is mainly used for debugging network traffic.

Storing Captured Packets to a.pcap File

Wireshark can store captured packets to a.pcap file. The capture file can be located on the following storage devices:

• Catalyst 4500 series switch on-board flash storage (bootflash:)
• external flash disk (slot0:)
• USB drive (usb0:)

Note Do not attempt to use Wireshark with any other devices.

When configuring a Wireshark capture point, you can associate a filename. When the capture point is activated, Wireshark creates a file with the specified name and writes packets to it. If the file already exists when the file is associated or the capture point is activated, Wireshark queries you as to whether the file can be overwritten. Only one capture point may be associated with a given filename.

If the destination of the Wireshark writing process is full, Wireshark fails with partial data in the file. You must ensure that there is sufficient space in the file system before you start the capture session. With Cisco IOS Release IOS XE 3.3.0SG, the file system full status is not detected for some storage devices.

You can reduce the required storage space by retaining only a segment, instead of the entire packet. Typically, you do not require details beyond the first 64 or 128 bytes. The default behavior is to store the entire packet.

To avoid possible packet drops when processing and writing to the file system, Wireshark can optionally use a memory buffer to temporarily hold packets as they arrive. Memory buffer size can be specified when the capture point is associated with a.pcap file.

Decoding and Displaying Packets

Wireshark can decode and display packets to the console. This functionality is possible for capture points applied to live traffic and for capture points applied to a previously existing.pcap file.

Note Decoding and displaying packets may be CPU intensive.

Wireshark can decode and display packet details for a wide variety of packet formats. The details are displayed by entering the monitor capture name start command with one of the following keyword options, which place you into a display and decode mode:

• brief—Displays one line per packet (the default).
• detailed—Decodes and displays all the fields of all the packets whose protocols are supported. Detailed mode require more CPU than the other two modes.
• (hexadecimal) dump—Displays one line per packet as a hexadecimal dump of the packet data and the printable characters of each packet.

When we enter the capture command with the decode and display option, the Wireshark output is returned to Cisco IOS and displayed on the console unchanged.

Displaying Live Traffic

Wireshark receives copies of packets from the Catalyst 4500 series switch core system. Wireshark applies its capture and display filters to discard uninteresting packets, and then decodes and displays the remaining packets.

Displaying from the.pcap File

Wireshark can decode and display packets from a previously stored.pcap file and direct the display filter to selectively displayed packets. A capture filter is not applicable in this situation.

Storing and Displaying Packets

Functionally, this mode is a combination of the previous two modes. Wireshark stores packets in the specified.pcap file and decodes and displays them to the console. Only the core and capture filters are applicable here.

Activating and Deactivating Wireshark Capture Points

After a Wireshark capture point has been defined with its attachment points, filters, actions, and other options, it must be activated. Until the capture point is activated, it does not actually capture packets.

Before a capture point is activated, some sanity checks are performed. A capture point cannot be activated if it has neither a core system filter nor attachment points defined. Attempting to activate a capture point that generates an error.

The capture and display filters are specified as needed.

After Wireshark capture points are activated, they can be deactivated in multiple ways. A capture point that is storing only packets to a.pcap file can be halted manually or configured with time or packet limits, after which the capture point halts automatically. Only packets that pass the Wireshark capture filter are counted against the packet limit threshold.

When a Wireshark capture point is activated, a fixed rate filter is applied automatically in the hardware so that the CPU is not flooded with Wireshark-directed packets. The disadvantage of the rate filter is that you cannot capture contiguous packets beyond the established rate even if more resources are available.

Wireshark Features used in Switches

This section describes how Wireshark features function in the Catalyst 4500 series switch environment:

• Layer 2 security features—Packets that are dropped by Layer 2 security features (such as port security, MAC address filtering, and spanning tree) are not captured by Wireshark. This differs from the behavior of SPAN.
• Classification-based security features—Packets that are dropped by input classification-based security features (such as ACLs and IPSG) are not caught by Wireshark capture points that are connected to attachment points at the same layer. In contrast, packets that are dropped by output classification-based security features are caught by Wireshark capture points that are connected to attachment points at the same layer. The logical model is that the Wireshark attachment point occurs after the security feature lookup on the input side, and symmetrically before the security feature lookup on the output side.

Wireshark capture policies connected to Layer 2 attachment points in the input direction capture packets dropped by Layer 3 classification-based security features. Symmetrically, Wireshark capture policies attached to Layer 3 attachment points in the output direction capture packets dropped by Layer 2 classification-based security features.

• Routed ports and Layer 3 port channels—When a routed port or Layer 3 port channel is used as a Wireshark attachment point, the The policy that is applied to capture the packets is treated as attached at Layer 3. Wireshark only captures packets that are being routed by the interface.
• VLANs—When a VLAN is used as a Wireshark attachment point, packets are captured in both input and output directions. A packet that is bridged in the VLAN generates two copies, one on input and one on output.
• Private VLANs—Secondary PVLANs are disallowed as Wireshark attachment points. Using a primary PVLAN as a Wireshark attachment point enables capture of packets in the primary PVLAN and all associated secondary PVLANs. The entire PV domain becomes the attachment point.
• Redirection features—In the input direction, features traffic redirected by Layer 3 (such as PBR and WCCP), are logically later than Layer 3 Wireshark attachment points. Wireshark captures these packets even though they might later be redirected out another Layer 3 interface. Symmetrically, output features redirected by Layer 3 (such as egress WCCP) are logically prior to Layer 3 Wireshark attachment points, and Wireshark will not capture them.
• Classification copy features—Features that generate copies of packets from the role-based and Security lookup types are compatible with Wireshark. Multiple copies of these packets are generated.
• SPAN—Wireshark cannot capture packets on interface configured as a SPAN source or destination.

Wireshark on VSS

Wireshark is supported on the VSS, and usage is similar to the Standalone switch. You need to create and delete capture points for the VSS active and VSS standby switches on the VSS active switch. You need to start and stop capture operations on VSS active switch, once you have issued the attachment points for a capture session on the active switch.

Default Wireshark Configuration

Table 68-1 shows the default Wireshark configuration.

Defining, Modifying, or Deleting a Capture Point

Although listed in sequence, the steps to specify values for the options can be executed in any order. You can also specify them in one, two, or several lines. Except for attachment points, which can be multiple, you can replace any value with a more recent value by redefining the same option, in the following order:

Step 1 Define the name that identifies the capture point.

Step 2 Specify the attachment point with which the capture point is associated.

Multiple attachment points can be specified. Range support is also available both for adding and removing attachment points.

Step 3 Define the core system filter, defined either explicitly, through ACL or through a class map.

Step 4 Specify the session limit (in seconds or packets captured).

Step 5 Specify the packet segment length to be retained by Wireshark.

Step 6 Specify the file association, if the capture point intends to capture packets rather than merely display them.

Step 7 Specify the size of the memory buffer used by Wireshark to handle traffic bursts.

To filter the capture point, use the following commands:

To define a capture point, use the following commands:

To clear the buffer contents, use the following command

To start and stop a capture point, use the following command:

Examples

Associating or Disassociating a Capture File

Specifying a Memory Buffer Size for Packet Burst Handling

Defining an Explicit Core System Filter to Match Both IPv4 and IPv6 TCP Traffic

Defining a Core System Filter Using an Existing ACL or Class Map

Activating and Deactivating a Capture Point

A capture point cannot be activated unless an attachment point and a core system filter have been defined and the associated filename (if any) does not already exist. A capture point with no associated filename can only be activated to display. If no capture or display filters are specified, all of the packets captured by the core system filter are displayed. The default display mode is brief.

To activate or deactivate a capture point, perform these tasks:

Configuring Wireshark on VSS

To configure Wireshark in the VSS active switch, perform the following step:

Example: Displaying a Brief Output from a.pcap File

You can display the output from a.pcap file by entering:

Example: Displaying Detailed Output from a.pcap File

You can display the detailed.pcap file output by entering:

Example: Displaying a Hexadecimal Dump Output from a.pcap File

You can display the hexadecimal dump output by entering:

Example: Displaying Packets from a.pcap File with a Display Filter

You can display the.pcap file packets output by entering:

Example: Simple Capture and Display

This example shows how to monitor traffic in the Layer 3 interface Gigabit 3/1:

Step 1 Define a capture point to match on the relevant traffic by entering:

Note To avoid high CPU utilization, a low packet count and duration as limits has been set.

Step 2 Confirm that the capture point has been correctly defined by entering:

Step 3 Start the capture process and display the results.

Step 4 Delete the capture point by entering:

Example: Simple Capture and Store

This example shows how to capture packets to a filter.

Step 1 Define a capture point to match on the relevant traffic and associate it to a file by entering:

Step 2 Confirm that the capture point has been correctly defined by entering:

Step 3 Launch packet capture by entering:

Step 4 After sufficient time has passed, stop the capture by entering:

Note Alternatively, you could let the capture operation stop automatically after the time has elapsed or the packet count has been met.

The mycap.pcap file now contains the captured packets.

Step 5 Display the packets by entering:

Step 6 Delete the capture point by entering:

Example: Using Buffer Capture

This example shows how to use buffer capture:

Step 1 Launch a capture session with the buffer capture option by entering:

Step 2 Determine whether the capture is active by entering:

Step 3 Display the packets in the buffer by entering:

Notice that the packets have been buffered.

Step 4 Display the packets in other display modes.

Step 5 Clear the buffer once, wait for 10 seconds, then stop the traffic by entering:

Wait for 10 seconds and stop the traffic.

Confirm that the same set of packets are displayed after this time gap by entering:

Step 6 Clear the packets from the buffer by entering:

Step 7 Confirm that the buffer is now empty by entering:

Wait about 10 seconds.

Step 8 Display the buffer contents.

Step 9 Restart the traffic, wait about 10 seconds, then display buffer contents by entering:

Step 10 Store the buffer contents to the mycap1.pcap file in the internal bootflash: storage device.

Step 11 Check that the file has been created and that it contains the packets by entering:

Step 12 Stop the packet capture and display the buffer contents by entering:

Step 13 Clear the buffer and then try to display packets from the buffer by entering:

Step 14 Delete the capture point by entering:

Example: Capture Sessions

The following examples shows how to start or stop a capture session in various modes:

Example: Capture and Store in Lock-step Mode

This example captures live traffic and stores the packets in lock-step mode to achieve a high capture rate.

Note The capture rate might be slow for the first 15 seconds. If possible and needed, start the traffic 15 seconds after the capture session has started.

Step 1 Define a capture point to match on the relevant traffic and associate it to a file by entering:

Step 2 Confirm that the capture point has been correctly defined by entering:

Step 3 Launch packet capture by entering:

Let the capture operation stop automatically after the time has elapsed or the packet count has been met.

The mycap.pcap file now contains the captured packets.

Step 4 Display the packets by entering:

Step 5 Delete the capture point by entering:

Example: Simple Capture and Store in Lock-step with High-speed Mode

This example shows how to capture live traffic and store the packets in lock-step with high-speed mode to achieve high capture rate.

Note The capture rate might be slow for the first 15 seconds. If possible and necessary, start the traffic 15 seconds after the capture session starts.

Step 1 Define a capture point to match on the relevant traffic and associate it to a file by entering:

Step 2 Confirm that the capture point has been correctly defined by entering:

Step 3 Launch packet capture by entering:

Let the capture operation stop automatically after the time has elapsed or the packet count has been met.

The mycap.pcap file now contains the captured packets.

Step 4 Display the packets by entering:

Step 5 Delete the capture point by entering:

Example: Simple Capture and Store of Packets in Egress Direction

This example shows how to capture live traffic and store the packets in egress direction using lock-step with high-speed mode.

Step 1 Define a capture point to match on the relevant traffic and associate it to a file by entering:

Step 2 Confirm that the capture point has been correctly defined by entering:

Step 3 Launch packet capture by entering:

Note Let the capture operation stop automatically after the time has elapsed or the packet count has been met.

The mycap.pcap file now contains the captured packets.

Step 4 Display the packets by entering:

Step 5 Delete the capture point by entering:

Example: Capturing and Storing in a file

This example shows how to do a simple capture and store operation after the attachment point is issued on the VSS active switch:

Step 1 Launch a capture session by entering the following commands in VSS active switch:

Step 2 After the capture session concludes, check that the capture file has stored the packets:

Example: Capturing and Storing in a File with Display

This example shows how to perform a basic capture and store operation with the display option in brief mode after the attachment point is issued on the VSS active switch:

Step 1 Prepare a capture session by entering the following commands in VSS active switch:

Step 2 Start the capture session with display option in brief mode:

Example: Circular Buffer Usage

This example shows how to do a simple capture and store operation with display option after the attachment point is issued on the VSS active switch:

Step 1 Prepare the capture session by entering the following commands in VSS active switch:

Step 2 Start the session in VSS active switch. Periodically, check that the packets are stored in the capture file.

Step 3 Once the capture session is over, delete the capture point if it is no longer needed.