Forum Discussion

refra_151287's avatar
Feb 22, 2016

tcpdump limitation @ Viprion multiple blades

Hi all, based on the below link: https://support.f5.com/kb/en-us/solutions/public/6000/500/sol6546.html

 

"When tcpdump is run on an interface on a VIPRION system, the tcpdump command must be run on the same blade in which the interface belongs. For example, if you are logged into blade 1 and you want to run tcpdump on interface 2/2.1, you must log into blade 2 before running the tcpdump command."

 

in my design, I have trunk with two interfaces 1/1.1 and 2/1.1, so based on the previous description if we performed a tcpdump at blade1, I will not get any traffic traverses through bldae2? or it will be performed as trunk and all traffic will be captured?

 

9 Replies

  • I have trunk with two interfaces 1/1.1 and 2/1.1, so based on the previous description if we performed a tcpdump at blade1, I will not get any traffic traverses through bldae2? or it will be performed as trunk and all traffic will be captured?

     

    it might not be an answer you are looking for but you can run 2 instances of tcpdump and merge them later, can't you?

     

    by the way, why don't you run tcpdump on interface vlan or interface 0.0 (instead of physical interface)?

     

    • refra_151287's avatar
      refra_151287
      Icon for Cirrus rankCirrus
      If I did capture on interface 0.0 on blade1, will i get traffic traverse blade2? also I like capturing on vlan if i have one vlan the traffic pass through, but at specific design the traffic traverse through 6 different vlans :)
  • I have trunk with two interfaces 1/1.1 and 2/1.1, so based on the previous description if we performed a tcpdump at blade1, I will not get any traffic traverses through bldae2? or it will be performed as trunk and all traffic will be captured?

     

    it might not be an answer you are looking for but you can run 2 instances of tcpdump and merge them later, can't you?

     

    by the way, why don't you run tcpdump on interface vlan or interface 0.0 (instead of physical interface)?

     

    • refra_151287's avatar
      refra_151287
      Icon for Cirrus rankCirrus
      If I did capture on interface 0.0 on blade1, will i get traffic traverse blade2? also I like capturing on vlan if i have one vlan the traffic pass through, but at specific design the traffic traverse through 6 different vlans :)
  • You are correct, you will not get any traffic from traffic traversing physical interfaces on blade 2. For these reasons I always recommend capturing on VLANs on Viprion when you know the ingress and egress VLANs(though this does mean you need two separate captures to get the traffic from both VLANs.)

     

    • refra_151287's avatar
      refra_151287
      Icon for Cirrus rankCirrus
      thanks but at specific design the same traffic passes through 6 vlans so i need to get the whole traffic bu issuing 0.0 or capture at the physical interface,
  • You are correct, you will not get any traffic from traffic traversing physical interfaces on blade 2. For these reasons I always recommend capturing on VLANs on Viprion when you know the ingress and egress VLANs(though this does mean you need two separate captures to get the traffic from both VLANs.)

     

    • refra_151287's avatar
      refra_151287
      Icon for Cirrus rankCirrus
      thanks but at specific design the same traffic passes through 6 vlans so i need to get the whole traffic bu issuing 0.0 or capture at the physical interface,
  • If I did capture on interface 0.0 on blade1, will i get traffic traverse blade2?

     

    yes

     

    I like capturing on vlan if i have one vlan the traffic pass through, but at specific design the traffic traverse through 6 different vlans

     

    in that case, you can capture on interface 0.0.