NCS55 SPAN to File(New Feature)

一直以来SPAN都是作为排查丢包问题很好用的feature, 但是在XR低版本上存在很多的限制,比如只支持local SPAN, 只能要求现场有人协助连个PC,将流量SPAN到PC上进行抓包,现在从XR 7.1.2 版本开始我们支持将SPAN的流量保存成一个文件,可以直接远程从设备上copy 出来。

SPAN Feature Support

ASR9kDNXSpitFire
Local SPANSupported-3.9.1NCS5500: Supported-6.1.1Being targetted for 7.2.1
Remote SPANSupported-3.9.1
Sampled SPANSupported-5.1.0
ERSPANNoNCS5500: Supported- 6.1.31Supported-7.2.1
MPLS-ERSPAN
PW-SPANSupported- 4.0.1Supported- 7.0.1  ( no support in 71x)No
ACL Based Traffic MirroringSupported-4.0.1NCS5500: Supported-6.1.1NCS560:  SupportedNCS540: SupportedSupported
SPAN to File7.1.27.1.27.2.2
SPAN to File PCAPngNo7.3.1No
CloudSpanNoNoNo

配置说明

#### 不同版本或许有些许出入, 一切以CCO文档为准
monitor-session [span_name] ethernet
 destination file size [size] [buffer-type linear]
interface [interface_name]
 monitor-session [span_name] ethernet [direction rx-only] port-level
 
buffer type 有两种, Linear/Circular, 默认不配置是Circular。
Linear:一旦缓冲区已满,就不会记录更多数据包。
Circular:一旦缓冲区已满,开始覆盖存储数据包。

SPAN to File 提供了 1000-1000000 KB 的缓冲区范围。默认缓冲区大小设置为 1000 KB。
 
### Start/stop packet capture
默认配置完以上的配置是不会自动开启capture的,需要额外命令start/stop

monitor-session <name> packet-collection start
monitor-session <name> packet-collection stop [ discard-data | write directory <dir> filename <filename> ]

如果添加discard-data选项,则简单地清除缓冲区,而如果write指定了该选项,则在清除之前将缓冲区写入磁盘。

示例

IXIA ---Ten0/0/0/1--- NCS55A1---- Other Router

IXIA 会持续发送100Mbps的穿越流量给NCS55, 100Mbps = 12.5MB/s

RP/0/RP0/CPU0:NCS-55A2-12#monitor interface TenGigE0/0/0/0 TenGigE0/0/0/1      
Sun Jun  6 05:54:07.887 UTC
NCS-55A2-12          Monitor Time: 00:00:40          SysUptime: 75:42:59

Protocol:General
Interface             In(bps)      Out(bps)     InBytes/Delta  OutBytes/Delta
Te0/0/0/0              1000/  0%   100.4M/  1%    48.5M/0         37.3G/25.0M      <<<<<<<
Te0/0/0/1             99.6M/  0%        0/  0%   304.1G/24.8M      8.0G/170   

Quit='q',     Clear='c',    Freeze='f', Thaw='t',
Next set='n', Prev set='p', Bytes='y',  Packets='k'
(General='g', IPv4 Uni='4u', IPv4 Multi='4m', IPv6 Uni='6u', IPv6 Multi='6m')

RP/0/RP0/CPU0:NCS-55A2-12#show run monitor-session 
% Incomplete command.
RP/0/RP0/CPU0:NCS-55A2-12#show run monitor-session  span_to_file
Sun Jun  6 06:06:37.404 UTC
monitor-session span_to_file ethernet
 destination file size 1000000
!
RP/0/RP0/CPU0:NCS-55A2-12#show run int tenGigE 0/0/0/1
Sun Jun  6 06:06:50.713 UTC
interface TenGigE0/0/0/1
 cdp
 vrf GLOBAL
 ipv4 address 100.1.1.1 255.255.255.0
 ipv6 address 2012::1/64
 monitor-session span_to_file ethernet port-level
 !
 load-interval 30
!

RP/0/RP0/CPU0:NCS-55A2-12#monitor-session span_to_file packet-collection start
Sun Jun  6 05:51:48.480 UTC
RP/0/RP0/CPU0:NCS-55A2-12#monitor-session span_to_file packet-collection stop write directory /misc/disk1 filename span_to_file
Sun Jun  6 05:52:22.473 UTC

</misc/disk1>  为harddisk:, Ten0/0/0/1 属于板卡0/0/CPU0 ,所以文件会存储在node0_0_CPU0 中
[xr-vm_node0_RP0_CPU0:~]$cd /misc/disk1/node0_0_CPU0
[xr-vm_node0_RP0_CPU0:/misc/disk1/node0_0_CPU0]$ls -lh
total 157M
-rw-r--r--. 1 root root 157M Jun  6 05:52 span_to_file.pcap
[xr-vm_node0_RP0_CPU0:/misc/disk1/node0_0_CPU0]$

或者
RP/0/RP0/CPU0:NCS-55A2-12#dir harddisk:/node0_0_CPU0
Sun Jun  6 06:20:03.560 UTC

Directory of harddisk:/node0_0_CPU0
783365 -rw-r--r--. 1 164039152 Jun  6 05:52 span_to_file.pcap

把文件从设备上COPY出来, 这里用了SCP

xuxing@XUXING-WT1:/mnt/c/Users/xuxing.CISCO/Desktop$ scp admin@10.122.166.235:/misc/disk1/node0_0_CPU0/span_to_file.pcap .
Password:
span_to_file.pcap                                                                                        4% 7088KB 225.7KB/s   11:18 ETA


span_to_file.pcap

注意

  • 2021-06-06

测试发现, SPAN采集了34s, 理论上应该是34X12.5=425MB的流量被存储下来, 但是只生成的157MB的文件,是有些数据包没有被dump下来, 因为我使用的软件版本是测试版本,不确认这个情况为该feature的问题还是因为我这个测试版本不完善导致, 后续如果有时间再找个设备测试下。

           

No comments

Comments feed for this article

Reply

Your email address will not be published.