packet-capture to file on HPE 5130 5700 and 5930

[AlexGraser]

Hi All,

Does any one know how to do a packet capture (not port mirroring!) which is saved to a file on the following switch models?

HPE 5130 Software Version 7.1.045, Release 1120P07

HPE 5700-32XGT Software Version 7.1.045, Release 2422P01

HPE 5930 Software Version 7.1.045, Release 2422P01

I´ve found some documents for example "HPE FlexNetwork 5130 HI Switch Series Network Management and Monitoring Command Reference" Document-Version 6W100-20151201 and there is a command described (packet-capture on page 321) which is not available on my 5130.

In another document "HPE FlexFabric 5700 Switch Series Network Management and Monitoring Configuration Guide" Document-Version 6W100-20160331 the same command (packet-capture) is described, but there is the following statement: "To use the packet capture feature, you must install the feature image by using the boot-loader,
install, or issu command."

My Question is:

what do i have to do to be able to make a packet-capture to file?

Do I have to install a specific feature and if so, where can I get this feature and how is it installed?

Thank you very much for your help!

greetings,

Alex.

[sdide · Accepted solution]

Hi,

you need to install the packet-capture feature image.

For example when you get the latest image for the 5130. R3113P05

You also get the file "5130ei-cmw710-packet-capture-r3113p05.bin"

You need to install this feature image to get the packet-capture features. Run a:

install activate feature flash:/5130ei-cmw710-packet-capture-r3113p05.bin

needs to look something like this

<HP-5130-24G>display install active 
Active packages on slot 1:
  flash:/5130ei-cmw710-boot-r3113p05.bin
  flash:/5130ei-cmw710-system-r3113p05.bin
  flash:/5130ei-cmw710-packet-capture-r3113p05.bin

Then you're good to go with

<HP-5130-24G>packet-capture interface gi1/0/1 brief 
Capturing on 'GigabitEthernet1/0/1'
  1   0.000000 00:0a:b8:df:7b:84 -> 01:00:0c:cc:cc:cd STP 68 RST. Root = 8192/599/00:0a:b8:df:7b:80  Cost = 0  Port = 0x8004
....

and so forth.

Regards

[Jannie Hanekom]

Thanks!  This clear & concise answer certainly helped me quite a bit.

Additional tip for the next person reading this thread: the packet capture feature might not become available in the session you used to install the software with, leading to frantic hunts for documentation.

In my case the solution was simple: I had to disconnect my current session and log back in again before the "packet-capture" command became available.

[spgsitsupport]

And how do I capture file which might be reasonably BIG?

Internal storae could unlikely be big enough

And what about need for reboot? - as mentioned here

Seb

[siverby]

If you want to capture more data than will fit on flash you need to use mirror port

I did not have to reboot 5700 after installing packet-capture

When I run packet-capture on an interface I only see STP packets, just like in the example above. How do I see all packets? Specifically I am looking for VLAN tags of ARP requests.

The example in Network Management and Monitoring uses mirror-to cpu without exmplaining why so I guess traffic needs to be mirrored to CPU for the switch to be able to capture them. I tried this but still only see STP:

traffic behavior cpumirrorbehavior
mirror-to cpu
quit
traffic classifier cpumirrorclassifier
if-match any
quit
qos policy cpumirrorpolicy
classifier cpumirrorclassifier behavior cpumirrorbehavior
quit
int te1/0/38
qos apply policy cpumirrorpolicy inbound
qos apply policy cpumirrorpolicy outbound
quit
quit
packet-capture interface te1/0/38

[samuelh]

i am trying to enable packet capture on a 5130 switch with version R1122P02

tried the install activate but this does not work.

We added the packet capture.bin using winscp.

any idea how to enable the feature?

does it require reboot of the switch?

[sdide]

Hi siverby,

I did the same as you did, except I did not match "any" in the classifier, but an acl. Worked for med on a 5130-24G-SFP-4SFP+ EI running R3115P05

I had

]acl number 3033
]acl-adv-3033]rule permit ip source X.X.X.X 0
]quit
...
classifier-clas1]if-match acl 3033

It worked like expected.
I havent tried "if-match any", because I'm a little worried about what happens if I send all my traffic to the CPU.

Regards

[sdide]

Hi samuelh

What output does the command "]display install active"  yield?
(and did you get an error message when you tried to activate it?)

Regards