TCPDump

Any traffic coming to or from the ___ of the Arista is visible when running the tcpdump utility on the Arista.

tcpdump allows users to instantly analyze important traffic such as ___, as well as any other traffic that is destined for the switch itself.

The Linux ___ command can be used to see the available interfaces in the Linux kernel.

ifconfig: The list of interfaces will reflect each of the physical interfaces on the Arista switch as well as any ___ interfaces.

Any VLAN which has been assigned an ___ will show up as a VLAN interface.

Filter by VLAN interface

The ‘-v’ and ‘-vv’ flags can be used to provide ___ output.

Filter traffic on a specific destination port number

List all network interfaces available for capture

By default, tcpdump attempts to resolve IP addresses and port numbers into ___

Disable hostname resolution using the __ flag.

Disable hostname AND port name resolution using the __ flag.

Stop capturing after 10 packets

Filter by IP address (source or destination) using 10.95.65.1

Filter traffic by interface po50

Filter traffic by source IP address, using 10.95.65.1

Filter traffic by destination IP address, using 10.95.65.1

Filter traffic by protocol (ICMP)

Filter traffic to or from host 10.95.65.1 of type ICMP. Disable name/port resolution and limit capture to 5 packets.

Filter SSH traffic destined to host 10.95.65.1

How do I see LLDP packets coming from an interface?

My server is port-channeled to my Arista switch, and it is not coming up.  How do I capture LACP packets coming to and from the server to form the port-channel?

LLDP well-known multicast MAC address

LACP well-known multicast MAC address

Filter SSL traffic to/from IP 10.95.65.1 on Management0. Write the capture to test.pcap on flash.

Read the first packet from test.pcap in Flash. Disable IP and port name resolution.

How do I capture OSPF packets between neighbors?

Listen on all interfaces just to see if you're seeing any traffic.

Increase the amount of packet information you get back.

Show the packet’s contents in both hex and ASCII.

Same as -X, but also shows the ethernet header.

Only get x number of packets and then stop.

Print absolute sequence numbers.

Show minimal protocol information.

Filtering for a specific host with VLAN tags

Filtering for either arp or icmp without VLAN tags

Filtering for either arp or icmp with VLAN tags

Filtering for either arp or icmp with or without VLAN tags

The ‘vlan’ keyword in a tcpdump filter changes the lookup offsets for all other keywords ___ the keyword.  This behavior is irrespective of parentheses.

Filter for BPDUs Without VLAN tags i.e. RSTP/MSTP/untagged native VLAN in Rapid PVST

Filter for BPDUs With VLAN tags i.e. tagged VLAN BPDUs in Rapid PVST

Print all packets but NOT those from host 00:25:90:32:ec:2a

Filter for VXLAN VNI 200

Filter for a VXLAN inner destination of MAC 28:99:3a:8f:b1:41

Filter for a VXLAN inner source MAC of 28:99:3a:8f:ae:a7

Filter for a VXLAN iinner source IP of 20.20.20.10

Filter for a VXLAN inner destination IP of 20.20.20.5

we can punt traffic to CPU to take captures. It will ___ the CPU as policies rate limiting traffic to CPU are in place (about 1Gb/s)

LACP packets must be viewed on ___, not the port-channel!

Filtered Mirroring ___: Configure an ACL with entries that match traffic we are interested in (TX, RX, or both) ending with "mirror session <session name>"

Filtered Mirroring ___: Set the last ACL rule as permit ip any any (If the interface doesn’t already have an ACL)

Filtered Mirroring ___: Assign the ACL to the interface we would like to capture traffic on

Filtered Mirroring ___: Add a destination monitor session port Ethernet, Port-channel, CPU or Tunnel

Filtered Mirroring: Associate ACL entries with a monitor session using the key words ___

Print traffic from the monitor session pictured. Filter traffic to/from host 10.95.65.1. Disable host name and port name resolutions.

Configure the switch to automatically send sampled LANZ traffic to the CPU

Enable LANZ

Configure the switch to enable packet sampling of LANZ traffic

This command configures a port mirroring session to truncate mirrored packets, retaining only the first 128-192 bytes.

Packet truncation can be used to prevent ___ of a monitor session’s destination port. It helps control the utilization of the Mirror CoPP. 

packet ___ applies to the mirroring session as a whole, and cannot be applied to individual source ports.

On Sand, the size of truncated packets can be set to either ___ or ___ bytes.

On Strata/Alta, the number of bytes to be retained when truncating packets is fixed at ___