Flashcards: TCPDump

Any traffic coming to or from the ___ of the Arista is visible when running the tcpdump utility on the Arista.

tcpdump allows users to instantly analyze important traffic such as ___, as well as any other traffic that is destined for the switch itself.

ifconfig: The list of interfaces will reflect each of the physical interfaces on the Arista switch as well as any ___ interfaces.

Any VLAN which has been assigned an ___ will show up as a VLAN interface.

Filter by VLAN interface

The ‘-v’ and ‘-vv’ flags can be used to provide ___ output.

Filter traffic on a specific destination port number

By default, tcpdump attempts to resolve IP addresses and port numbers into ___

Stop capturing after 10 packets

Filter by IP address (source or destination) using 10.95.65.1

Filter traffic by interface po50

Filter traffic by source IP address, using 10.95.65.1

Filter traffic by destination IP address, using 10.95.65.1

Filter traffic by protocol (ICMP)

Filter traffic to or from host 10.95.65.1 of type ICMP. Disable name/port resolution and limit capture to 5 packets.

Filter SSH traffic destined to host 10.95.65.1

How do I see LLDP packets coming from an interface?

My server is port-channeled to my Arista switch, and it is not coming up.  How do I capture LACP packets coming to and from the server to form the port-channel?

LLDP well-known multicast MAC address

LACP well-known multicast MAC address

Filter SSL traffic to/from IP 10.95.65.1 on Management0. Write the capture to test.pcap on flash.

Read the first packet from test.pcap in Flash. Disable IP and port name resolution.

How do I capture OSPF packets between neighbors?

Listen on all interfaces just to see if you're seeing any traffic.

Increase the amount of packet information you get back.

Show the packet’s contents in both hex and ASCII.

Same as -X, but also shows the ethernet header.

Only get x number of packets and then stop.

Filtering for a specific host with VLAN tags

Filtering for either arp or icmp without VLAN tags

Filtering for either arp or icmp with VLAN tags

Filtering for either arp or icmp with or without VLAN tags

The ‘vlan’ keyword in a tcpdump filter changes the lookup offsets for all other keywords ___ the keyword.  This behavior is irrespective of parentheses.

Filter for BPDUs With VLAN tags i.e. tagged VLAN BPDUs in Rapid PVST

Print all packets but NOT those from host 00:25:90:32:ec:2a

Filter for VXLAN VNI 200

Filter for a VXLAN inner destination of MAC 28:99:3a:8f:b1:41

Filter for a VXLAN inner source MAC of 28:99:3a:8f:ae:a7

Filter for a VXLAN iinner source IP of 20.20.20.10

Filter for a VXLAN inner destination IP of 20.20.20.5

we can punt traffic to CPU to take captures. It will ___ the CPU as policies rate limiting traffic to CPU are in place (about 1Gb/s)

LACP packets must be viewed on ___, not the port-channel!

Filtered Mirroring ___: Configure an ACL with entries that match traffic we are interested in (TX, RX, or both) ending with "mirror session <session name>"

Filtered Mirroring ___: Set the last ACL rule as permit ip any any (If the interface doesn’t already have an ACL)

Filtered Mirroring ___: Assign the ACL to the interface we would like to capture traffic on

Filtered Mirroring ___: Add a destination monitor session port Ethernet, Port-channel, CPU or Tunnel

This command configures a port mirroring session to truncate mirrored packets, retaining only the first 128-192 bytes.

Packet truncation can be used to prevent ___ of a monitor session’s destination port. It helps control the utilization of the Mirror CoPP. 

packet ___ applies to the mirroring session as a whole, and cannot be applied to individual source ports.

On Strata/Alta, the number of bytes to be retained when truncating packets is fixed at ___