Cisco Nexus 5000 Series Switch Fabric Manager Software Configuration Guide, NX-OS 4.0 (OL-16598-01, June 2008)

Send comments to [e-mail]
31-19
Nexus 5000 Series Switch Fabric Manager Software Configuration Guide
OL-16598-01
Chapter 31 Troubleshooting Your Fabric
Configuring a Fabric Analyzer
Sending Captures to Remote IP Addresses
Caution You must use the eth2 interface to capture control traffic on a supervisor module.
To capture remote traffic, use one of the following options:
• The capture interface can be specified in Wireshark as the remote device:
rpcap://<ipaddress or switch hostname>/eth2
For example:
rpcap://cp-16/eth2
rpcap://17.2.1.1/eth2
• The capture interface can be specified either in the capture dialog box or by using the -i option at
the command line when invoking Wireshark.
wireshark -i rpcap://<ipaddress|hostname>[:<port>]/<interface>
For example:
wireshark -i rpcap://172.22.1.1/eth2
or
wireshark -i rpcap://customer-switch.customer.com/eth2
Note For example, in a Windows 2000 setup, click Start on your desktop and choose Run. In the
resulting Run window, type the required command line option in the Open field.
Displaying Captured Frames
You can selectively view captured frames by using the display filters feature. For example, instead of
viewing all the frames from a capture, you may only want to view Exchange Link Protocol (ELP) request
frames. This feature only limits the captured view; it does not affect the captured or the saved frames.
Procedures to specify, use, and save display filters are already documented in the Wireshark website
(http://www.wireshark.org).
These examples show how to use this feature:
• To view all packets in a specified VSAN, use this expression:
mdshdr.vsan == 2
• To view all SW_ILS frames, use this expression:
fcswils
• To view class F frames, use this expression:
mdshdr.sof == SOFf
• To view all FSPF frames, use this expression:
swils.opcode == HLO || swils.opcode == LSU || swils.opcode == LSA