Breakintheweb's Weblog

Cisco IOS EPC

breakintheweb — Sat, 03 Sep 2011 17:48:17 +0000

Embedded packet capture (EPC) is a way to capture packets directly on a router. These packet captures can then be sent to a server (FTP,SCP,HTTP,ETC) for packet analysis in a program such as wireshark. EPC requires IOS version 12.4(20)t or greater.

The below code sets up a capture for interface fa0/0 and exports the capture to an ftp server.
monitor capture buffer BUFFER monitor capture buffer BUFFER size 512 max-size 256 monitor capture point ip cef FA0_0 fa0/0 both monitor capture point asso FA0_0 BUFFER monitor capture point start FA0_0 monitor capture buffer BUFFER export ftp://host/filename.pcap

The capture can be stopped with the following
monitor capture point stop FA0_0

You can determine if the capture is woring with the following.
show monitor capture buffer BUFFER parameters Rack1R1#show monitor capture buffer BUFFER parameters Capture buffer BUFFER (linear buffer) Buffer Size : 524288 bytes, Max Element Size : 256 bytes, Packets : 5 Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0 Associated Capture Points: Name : FA0_0, Status : Active Configuration: monitor capture buffer BUFFER size 512 max-size 256 linear monitor capture point associate FA0_0 BUFFER

More information can be found in the config guide under Cisco IOS Network Management Configuration Guide->Troubleshooting, Fault Management, and Logging->Embedded Packet Capture
Embedded Packet Capture

NOTEPAD++ and REGEX

breakintheweb — Mon, 13 Jul 2009 19:39:02 +0000

As i’ve been going though my mock CCIE labs, I’ve had to modify the initial configs before beginning each lab. The main problem i have is my routers are ISR’s and thus have the #/#/# format for modules vs the older #/# format. I was searching for an easy way to modify all of the initial configs prior to starting each lab. I ended up solving my problem with notepad++ and regex.

Notepad++ allows you to open multiple files at the same time in separate tabs. Notepad++ then allows you to do a find/replace across all OPEN documents using regex.

I first opened all my initial router configs in notepad++ and used the following settings below. Make sure regex is checked and you press replace all in all open documents.

The [0-9] = any number from 0-9. (E.G. Serial0/0 Serial0/1)

The Replace string uses a \1 which is replaced with the first Parentheses value from the find string above.

notepad++ can be found at http://notepad-plus.sourceforge.net/uk/site.htm

OSPF and Default routes

breakintheweb — Thu, 02 Jul 2009 18:25:09 +0000

For stub areas, a default route is not propogated by default. You must explicetely tell the ABR to send the default route into the NSSA area.

router ospf 1 area nssa default-information-originate

The above output will generate NSSA Type-2 external default route (LSA type-7).
The metric type for the default route above can be changed to a Type 1 with the metric command.

router ospf 1 area nssa default-information-originate metric-type 1

If the area is set to NSSA totally stuby area. An Inter-area default route will be created on the ABR and sent to the NSSA totally stubby area.
router ospf 1 area nssa default-information-originate no-summary

IP sla history

breakintheweb — Wed, 24 Jun 2009 14:18:00 +0000

I ran in to an issue where connectivity would drop randomly for around 1 minute. Sometimes this would happen multiple times a day. Other days would have no issues. To help facilitate troubleshooting of the issue, i created an ip sla session to span the path that tracks the last 25 failures.

ip sla 1 icmp-echo 10.1.1.1 source-ip 10.1.1.2 threshold 500 frequency 10 history filter failures history buckets-kept 25 history lives-kept 1 ip sla schedule 1 life forever start-time now

tclsh

breakintheweb — Mon, 22 Jun 2009 18:04:57 +0000

I was using a tcl script with the IEWB to test connectivity. The extra data included with the pings made it difficult to check the connectivity. I found the below code that will ping multiple devices and output the results in a clean format with either (OK, FAILED)

tclsh proc ping { IP } { set PING [ exec "ping $IP repeat 3" ] set PING [ regexp -inline -all {[\.!]{3}} $PING ] if { [ string first "!" $PING ] == -1 } { puts "[format "%-40s %s" "ping $IP" "\[FAILED\]" ]" } else { puts "[format "%-40s %s" "ping $IP" "\[ OK \]" ]" } }

foreach address { 155.1.146.1 155.1.146.4 155.1.146.6 155.1.67.6 155.1.67.7 155.1.79.7 155.1.79.9 155.1.9.9 155.1.37.7 155.1.37.3 155.1.13.1 155.1.13.3 155.1.23.3 155.1.23.2 155.1.10.10 155.1.108.10 155.1.108.8 155.1.8.8 155.1.58.8 155.1.58.5 155.1.5.5 155.1.45.5 155.45.1.4 155.1.0.1 155.1.0.2 155.1.0.3 155.1.0.4 155.1.0.5 } { ping $address}

And here are my results.

ping 155.1.146.1 [ OK ]
ping 155.1.146.4 [FAILED]
ping 155.1.146.6 [ OK ]
ping 155.1.67.6 [ OK ]
ping 155.1.67.7 [ OK ]
ping 155.1.79.7 [ OK ]
ping 155.1.79.9 [FAILED]
ping 155.1.9.9 [FAILED]
ping 155.1.37.7 [ OK ]
ping 155.1.37.3 [ OK ]
ping 155.1.13.1 [ OK ]
ping 155.1.13.3 [ OK ]
ping 155.1.23.3 [ OK ]
ping 155.1.23.2 [ OK ]
ping 155.1.10.10 [FAILED]
ping 155.1.108.10 [FAILED]
ping 155.1.108.8 [ OK ]
ping 155.1.8.8 [ OK ]
ping 155.1.58.8 [ OK ]
ping 155.1.58.5 [ OK ]
ping 155.1.5.5 [ OK ]
ping 155.1.45.5 [ OK ]
ping 155.45.1.4 [FAILED]
ping 155.1.0.1 [ OK ]
ping 155.1.0.2 [ OK ]
ping 155.1.0.3 [ OK ]
ping 155.1.0.4 [ OK ]
ping 155.1.0.5 [ OK ]

CCIE studies

breakintheweb — Wed, 26 Nov 2008 16:38:48 +0000

I’ve been working on my CCIE for a few months. I utilize a Cisco 2511 to connect to my lab remotely. I’ve found the following to be useful when going through mockup labs.

Exit a command (ping, traceroute, etc)
press “ctrl+shift+6″ twice consecutively

Remove all routing configuration
(config)# no ip routing
(config)# ip routing

Erase and reload all routers
You must have an active session from the 2511 (use # “show session” to verify )

send *
{enter}
wr erase
no
reload
{enter}

I’ll add more things as i think of them.

QinQ woes

breakintheweb — Thu, 10 Jul 2008 13:40:49 +0000

I spent a good amount of time troubleshooting a L2 link that is provided across two provider networks. The symptoms were packets above 1496bytes being dropped. I used ICMP echo packets to verify this.

# ping x.x.x.x size 1496
Sending 5, 1496-byte ICMP Echos to x.x.x.x, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

# ping x.x.x.x size 1497
Type escape sequence to abort.
Sending 5, 1497-byte ICMP Echos to x.x.x.x, timeout is 2 seconds:
…..
Success rate is 0 percent (0/5)

Our switch on each side has an MTU of 1500 with the provider facing link set to DOT1Q. This means packets being sent on the provider link can be 1500bytes plus the 4byte header for the Q tag. If the provider dosen’t set the link interfaces with an MTU of at least 1504bytes, the traffic will fragment and be dropped.

An easy way to verify the MTU issue on the provider network is to pass traffic in the native VLAN. Since this traffic isn’t carrying the extra 4byte vlan header tag it should pass.

-Justin