Traffic Capture

[luisrocha]

Hi to all,

Hi have 2 Directors 5016-NE1 and 2 Accelarators 6416, i need to capture traffic using tcpdump, fwmonitor whathever, can someone help me.

I have shutdown 1 director and 1 accelerator to force the traffic going to only one director. I access the serial port via root and run a tcpdump and a fwmonitor but cannot see all the traffic (I now this beacause i have a pc connected to a port mirror).

Additionaly i have disable fwaccell and run it again without success.

Question, when I need to capture traffic, it must be on the Director or on the Accelarator ? I think is in the Director right ?

Regards,
LR

[mohankumar]

Hi,

You can use following example for capturing info :

Login as root and run the following commands:

For any particular port :

ascpature -f "port 4404" -p 1
-f is filter and -p is physical port on accelerator.

ascpature -f "host 4.2.2.2" -p 1

Fwmonitor :

fw monitor -e 'accept ((src=192.168.1.100));'

[mohankumar]

tcpdump sometime doesn't work here