目录

前言
Step 1: 设定 Buffer
Step 2: 设定 Capture Point
Step 3: Associate
Step 4: 启动与停止
Step 5: 查看结果

前言

遇到网络问题时,撷取 Packet 来做 troubleshooting 是一个解决困难的好办法。如果在 PC 上我们可以用 Wireshark 这一类工具来做撷取,但如果要撷取的位置是在一些不方便插进 PC 的地方,例如在 Core Network 的 Router 中,我们就要使用 IOS 内建的 Packet Capture 功能了。Cisco IOS 在 Version 12.4(20) 以後开始支缓这个功能。不过,要在 IOS 上Capture Packet 真是複杂到不行!请细心阅读。

Step 1: 设定 Buffer

由於 Capture 到的 Packet 会储存在 Buffer 之中,我们首先要为 Buffer 定义一些参数。请使用 monitor capture buffer 指令, 是你为这 buffer 定义的名称。

Router#monitor capture buffer BUFFER_1 ?
  circular  Circular Buffer
  clear     Clear contents of capture buffer
  export    Export in Pcap format
  filter    Configure filters
  limit     Limit the packets dumped to the buffer
  linear    Linear Buffer(Default)
  max-size  Maximum size of element in the buffer (in bytes)
  size      Packet Dump buffer size (in Kbytes)
 

首先要设定的是 Linear 还是 Circular?

  • Linear 的意思是这个 buffer 如果满了,Capture 就会自动停止。
  • Circular 就是 buffer 会被循环使用,如果 buffer 满了的话,旧的 capture 会被新的 capture 覆盖。
Router#monitor capture buffer BUFFER_1 ?
  circular  Circular Buffer
  clear     Clear contents of capture buffer
  export    Export in Pcap format
  filter    Configure filters
  limit     Limit the packets dumped to the buffer
  linear    Linear Buffer(Default)
  max-size  Maximum size of element in the buffer (in bytes)
  size      Packet Dump buffer size (in Kbytes)
 

在我们的例子中,我们尝试使用 Linear 设定。

Router#monitor capture buffer BUFFER_1 linear

然後要定义 Size 和 Max-size

  • Size 是为 buffer 设定容量。
  • Max-size 则设定每一个被 capture 的 packet 容量的最大限制,packet 太大超过了这个容量的话,超过了的部份就不会被 capture。
Router#monitor capture buffer BUFFER_1 ?
  circular  Circular Buffer
  clear     Clear contents of capture buffer
  export    Export in Pcap format
  filter    Configure filters
  limit     Limit the packets dumped to the buffer
  linear    Linear Buffer(Default)
  max-size  Maximum size of element in the buffer (in bytes)
  size      Packet Dump buffer size (in Kbytes)
 

我们试试把 size 设为 4096,max-size 设为 1024。

Router#monitor capture buffer BUFFER_1 size ?
   Buffer size in Kbytes : 102400K or less (default is 1024K)

Router#monitor capture buffer BUFFER_1 size 4096
Router#
Router#monitor capture buffer BUFFER_1 max-size ?
   Element size in bytes : 9500 bytes or less (default is 68 bytes)

Router#monitor capture buffer BUFFER_1 max-size 1024

接下来是考虑是否要加入 Filter,加入 Filter 可以让 buffer 缩细捕捉範围,只纪录 Access-list 所包含的 Packets,加入 Access-list 可以使分析时更加容易找出想要的结果。加入 Filter 前别忘记要先定义好 Access-list 喔。

Router#monitor capture buffer BUFFER_1 ?
  circular  Circular Buffer
  clear     Clear contents of capture buffer
  export    Export in Pcap format
  filter    Configure filters
  limit     Limit the packets dumped to the buffer
  linear    Linear Buffer(Default)
  max-size  Maximum size of element in the buffer (in bytes)
  size      Packet Dump buffer size (in Kbytes)
 
Router#monitor capture buffer BUFFER_1 filter access-list ?
       IP access list
   IP expanded access list
  WORD         Access-list name

Router#monitor capture buffer BUFFER_1 filter access-list 100

最後,我们用 show monitor capture buffer parameters 来验證一下 Buffer 的设定。留意 Associated Capture Points 一栏是空的,因为我们下一步才定义 Capture Point。

Router#show monitor capture buffer BUFFER_1 parameters
Capture buffer BUFFER_1 (linear buffer)
Buffer Size : 4194304 bytes, Max Element Size : 1024 bytes, Packets : 0
Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0
Associated Capture Points:
Configuration:
monitor capture buffer BUFFER_1 size 4096 max-size 1024 linear
monitor capture buffer BUFFER_1 filter access-list 100

Step 2: 设定 Capture Point

Capture Point 就是你需要撷取 Packet 的位置。使用的指令是 monitor capture point......

Router#monitor capture point ?
  associate     Associate capture point with capture buffer
  disassociate  Dis-associate capture point from capture buffer
  ip            IPv4
  ipv6          IPv6
  start         Enable Capture Point
  stop          Disable Capture Point

要撷取的是 IPv4 还是 IPv6 的 Packet?

Router#monitor capture point ?
  associate     Associate capture point with capture buffer
  disassociate  Dis-associate capture point from capture buffer
  ip            IPv4
  ipv6          IPv6
  start         Enable Capture Point
  stop          Disable Capture Point

再来是请问你是撷取的 Packet Flow 是使用 CEF 还是 process switching?

Router#monitor capture point ip ?
  cef               IPv4 CEF
  process-switched  Process switched packets

然後就可以为这个 Capture Point 的定义一个名称,最後才输入要 Capture 的位置和方向。

Router#monitor capture point ip cef POINT_1 gigabitEthernet 0/0 ?
  both  capture ingress and egress
  in    capture on ingress
  out   capture on egress

在这个测试中,我们尝试定义两个 Capture Point。

Router#monitor capture point ip cef POINT_1 gigabitEthernet 0/0 both
Router#
Jul 17 06:05:51.715: %BUFCAP-6-CREATE: Capture Point POINT_1 created.
Router#monitor capture point ip cef POINT_2 gigabitEthernet 0/1 both
Router#
Jul 17 06:08:02.419: %BUFCAP-6-CREATE: Capture Point POINT_2 created.

最後用 show monitor capture point all 指令检查一下刚才的设定。留意此时 Capture Point 状态是 Inactive 即是说设定是设定好了,但仍未被启动。

Router#show monitor capture point all
Status Information for Capture Point POINT_1
IPv4 CEF
Switch Path: IPv4 CEF            , Capture Buffer: None
Status : Inactive

Configuration:
monitor capture point ip cef POINT_1 GigabitEthernet0/0 both

Status Information for Capture Point POINT_2
IPv4 CEF
Switch Path: IPv4 CEF            , Capture Buffer: None
Status : Inactive

Configuration:
monitor capture point ip cef POINT_2 GigabitEthernet0/1 both

Step 3: Associate

把两个 Capture Point 连到 Buffer。

Router#monitor capture point associate POINT_1 BUFFER_1
Router#monitor capture point associate POINT_2 BUFFER_1

然後再检查 Buffer 的设定,看到有 Associated Capture Points了,意思是 在 POINT_1 和 POINT_2 这两个位置 Capture 的 Packet 将会放进 BUFFER_1 之中。

Router#show monitor capture buffer BUFFER_1 parameters
Capture buffer BUFFER_1 (linear buffer)
Buffer Size : 4194304 bytes, Max Element Size : 1024 bytes, Packets : 0
Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0
Associated Capture Points:
Name : POINT_1, Status : Inactive
Name : POINT_2, Status : Inactive
Configuration:
monitor capture buffer BUFFER_1 size 4096 max-size 1024 linear
monitor capture point associate POINT_1 BUFFER_1
monitor capture point associate POINT_2 BUFFER_1
monitor capture buffer BUFFER_1 filter access-list 100

Step 4: 启动与停止

一切準备就绪,现在可以启动 Packet Capture。

你可以选择逐一启动:

Router#monitor capture point start POINT_1
Router#monitor capture point start POINT_2

或干脆一次过启动全部:

Router#monitor capture point start all
Router#
Jul 17 06:15:58.263: %BUFCAP-6-ENABLE: Capture Point POINT_1 enabled.
Jul 17 06:15:58.263: %BUFCAP-6-ENABLE: Capture Point POINT_2 enabled.

现在可以见到 Capture Point 已经启动了。

Router#show monitor capture point all
Status Information for Capture Point POINT_1
IPv4 CEF
Switch Path: IPv4 CEF            , Capture Buffer: BUFFER_1
Status : Active

Configuration:
monitor capture point ip cef POINT_1 GigabitEthernet0/0 both

Status Information for Capture Point POINT_2
IPv4 CEF
Switch Path: IPv4 CEF            , Capture Buffer: BUFFER_1
Status : Active

Configuration:
monitor capture point ip cef POINT_2 GigabitEthernet0/1 both

当你觉得可以停止时,可以手动停止 Packet Capture:

Router#monitor capture point stop all
Router#
Jul 17 06:16:13.983: %BUFCAP-6-DISABLE: Capture Point POINT_1 disabled.
Jul 17 06:16:13.983: %BUFCAP-6-DISABLE: Capture Point POINT_2 disabled.

或等到 Buffer 全满了,Capture 会自动停止,因为我们在 Step 1 设定 Buffer 时选择了使用 Linear。

Router#
Jul 17 06:20:57.775: %BUFCAP-5-ELEM_TRIMMED: Element trimmed as there was not enough space in capture buffer BUFFER_1. Original Size: 1024; Copied Size: 388.
Jul 17 06:20:57.775: %BUFCAP-6-DISABLE: Capture Point POINT_1 disabled.
Jul 17 06:20:57.775: %BUFCAP-6-DISABLE: Capture Point POINT_2 disabled.
Jul 17 06:20:57.775: %BUFCAP-5-BUFFER_FULL: Linear Buffer associated with capture buffer BUFFER_1 is full.

Step 5: 查看结果

show monitor capture buffer dump 指令可以看看结果。

Router#show monitor capture buffer BUFFER_1 dump
06:17:34.495 UTC Jul 17 2014 : IPv4 LES CEF    : Gi0/0 None

28DD4590:          D48CB5F6 DD4018A9 05E7A35C      T.5v]@.).g#\
28DD45A0: 08004500 003C3381 00007F01 83EBC0A8  ..E..<3......k@(
28DD45B0: 0102C0A8 02020800 1FB90001 2DA26162  ..@(.....9..-"ab
28DD45C0: 63646566 6768696A 6B6C6D6E 6F707172  cdefghijklmnopqr
28DD45D0: 73747576 77616263 64656667 686900    stuvwabcdefghi.

06:17:34.495 UTC Jul 17 2014 : IPv4 LES CEF    : Gi0/0 Gi0/1

28DD4590:          D48CB5F6 DDE0D48C B5F6DD41      T.5v]`T.5v]A
28DD45A0: 08004500 003C3381 00007F01 83EBC0A8  ..E..<3......k@(
28DD45B0: 0102C0A8 02020800 1FB90001 2DA26162  ..@(.....9..-"ab
28DD45C0: 63646566 6768696A 6B6C6D6E 6F707172  cdefghijklmnopqr
28DD45D0: 73747576 77616263 64656667 686900    stuvwabcdefghi.

06:17:34.495 UTC Jul 17 2014 : IPv4 LES CEF    : Gi0/1 None

28DD4590:          D48CB5F6 DD41D48C B5F6DDE0      T.5v]AT.5v]`
28DD45A0: 08004500 003C3381 0000FE01 04EBC0A8  ..E..<3...~..k@(
28DD45B0: 0202C0A8 01020000 27B90001 2DA26162  ..@(....'9..-"ab
28DD45C0: 63646566 6768696A 6B6C6D6E 6F707172  cdefghijklmnopqr
28DD45D0: 73747576 77616263 64656667 686900    stuvwabcdefghi.

 --More--

唔......似乎不是常人可以理解的 😖,最好还是把结果 export 到 PC,然後放进 Wireshark 慢慢观摩吧。

Router#monitor capture buffer BUFFER_1 export ?
  ftp:    Location to dump buffer
  http:   Location to dump buffer
  https:  Location to dump buffer
  rcp:    Location to dump buffer
  scp:    Location to dump buffer
  tftp:   Location to dump buffer

因为 buffer 满了,如果需要重新 Capture 的话,必需先把 buffer 清除後,再启动 Capture。

Router#monitor capture buffer BUFFER_1 clear