ISR4K-IOS XE EPC
1、该操作在ISR4K的平台操作，简单的执行了一个控制层面的抓包
配置命令：
R01#monitor capture A control-plane both
R01#monitor capture A match any
R01#monitor capture A limit packets 100 <------100个报文抓取到后，EPC会自动停止
命令查看EPC A的参数：
R01#show monitor capture A
Status Information for Capture A
Target Type:
Interface: Control Plane, Direction :
Packet Capture duration: 0 (no limit)
Packet Size to capture: 0 (no limit)
Packet sampling rate: 0 (no sampling)
开启EPC：
R01#monitor capture A start
R01#show monitor capture A
Status Information for Capture A
Target Type:
Interface: Control Plane, Direction : both
Status : Active
Filter Details:
Capture all packets
Buffer Details:
Buffer Type: LINEAR (default)
Buffer Size (in MB): 10
Limit Details:
Number of Packets to capture: 100
Packet Capture duration: 0 (no limit)
Packet Size to capture: 0 (no limit)
Maximum number of packets to capture per second: 1000
Packet sampling rate: 0 (no sampling)
设备中运行了EIGRP、PPPoE等协议，而且远程通过SSH登录了这个设备。所以抓到了如下的报文。
R01#show monitor capture A buffer brief
-------------------------------------------------------------
# size timestamp source destination protocol
-------------------------------------------------------------
0 220 0.000000 192.168.2.149 -> 224.0.0.251 UDP
1 82 0.016997 10.16.9.1 -> 10.16.9.2 UDP
2 70 0.098054 94:C3:00:00:F2:2F -> 00:21:45:00:00:44 unknown
3 56 0.187038 28:FF:3C:3C:C8:67 -> 00:9A:D2:2D:BA:14 ARP
4 60 0.187038 00:9A:D2:2D:BA:14 -> 28:FF:3C:3C:C8:67 ARP
5 82 0.217035 10.16.9.1 -> 10.16.9.2 UDP
6 82 0.417037 10.16.9.1 -> 10.16.9.2 UDP
7 46 0.473034 192.168.2.149 -> 192.168.2.1 UDP
8 122 0.603017 94:F1:00:00:F2:2F -> 00:21:45:00:00:78 unknown
9 122 0.610021 10.16.9.1 -> 10.0.11.10 TCP
10 82 0.618016 10.16.9.1 -> 10.16.9.2 UDP
11 60 0.679017 00:9A:D2:2D:B9:99 -> 01:00:0C:CC:CC:CC LLC
12 70 0.769009 95:09:00:00:F2:2F -> 00:21:45:00:00:44 unknown
13 82 0.818018 10.16.9.1 -> 10.16.9.2 UDP
14 60 0.834008 00:9A:D2:2D:B9:90 -> 68:8F:84:EE:DC:E9 PPPoE Session Stage
15 133 0.834008 00:00:FF:2F:76:EC -> 45:C0:00:85:0D:AC unknown
16 133 0.835015 00:00:FF:2F:76:EA -> 45:C0:00:85:0D:AD unknown
17 122 0.842003 95:10:00:00:F2:2F -> 00:21:45:00:00:78 unknown
18 138 0.849007 10.16.9.1 -> 10.0.11.10 TCP
19 175 0.882010 7E:8D:00:00:F3:2F -> 00:21:45:00:00:AD unknown
20 175 0.889013 36:72:00:00:F3:2F -> 00:21:45:00:00:AD unknown
21 118 0.988007 10.0.254.125 -> 10.0.8.15 UDP
22 118 0.988007 10.0.254.125 -> 10.0.8.16 UDP
23 70 1.003997 95:19:00:00:F2:2F -> 00:21:45:00:00:44 unknown
24 82 1.016997 10.16.9.1 -> 10.16.9.2 UDP
25 74 1.022002 10.16.9.1 -> 224.0.0.10 EIGRP
26 162 1.036045 95:1C:00:00:F2:2F -> 00:21:45:00:00:A0 unknown
27 60 1.147047 00:9A:D2:2D:B9:91 -> 10:51:72:1B:36:5A PPPoE Session Stage
28 82 1.218042 10.16.9.1 -> 10.16.9.2 UDP
29 82 1.218042 10.16.9.1 -> 10.16.9.2 UDP
30 60 1.218042 00:9A:D2:2D:BA:10 -> FF:FF:FF:FF:FF:FF ARP
31 122 1.293036 95:22:00:00:F2:2F -> 00:21:45:00:00:78 unknown
32 106 1.296041 10.16.9.1 -> 10.0.11.10 TCP
33 590 1.296041 10.16.9.1 -> 10.0.11.10 TCP
34 66 1.296041 10.16.9.1 -> 10.0.11.10 TCP
35 70 1.401032 95:23:00:00:F2:2F -> 00:21:45:00:00:44 unknown
36 82 1.418029 10.16.9.1 -> 10.16.9.2 UDP
37 70 1.442030 95:24:00:00:F2:2F -> 00:21:45:00:00:44 unknown
38 82 1.619023 10.16.9.1 -> 10.16.9.2 UDP
39 74 1.625019 10.16.9.1 -> 224.0.0.10 EIGRP
40 90 1.637027 95:39:00:00:F2:2F -> 00:21:45:00:00:58 unknown
41 78 1.642017 192.168.2.174 -> 192.168.2.1 UDP
42 159 1.642017 192.168.2.1 -> 192.168.2.174 UDP
43 88 1.764019 192.168.2.163 -> 192.168.2.1 UDP
44 163 1.765011 192.168.2.1 -> 192.168.2.163 UDP
45 82 1.819009 10.16.9.1 -> 10.16.9.2 UDP
46 94 1.881003 192.168.2.163 -> 224.0.0.251 UDP
47 75 1.887014 192.168.2.149 -> 192.168.2.1 UDP
48 96 1.888006 10.91.10.189 -> 114.114.114.114 UDP
49 75 1.898015 192.168.3.56 -> 192.168.3.1 UDP
50 86 1.899007 10.91.10.189 -> 114.114.114.114 UDP
51 120 1.928012 68:8F:84:EE:DC:E9 -> 00:9A:D2:2D:B9:90 PPPoE Session Stage
52 168 1.929004 192.168.2.1 -> 192.168.2.149 UDP
53 70 1.938998 192.168.3.56 -> 192.168.3.1 UDP
54 94 1.940005 10.91.10.189 -> 114.114.114.114 UDP
55 150 1.940005 68:8F:84:EE:DC:E9 -> 00:9A:D2:2D:B9:90 PPPoE Session Stage
56 90 1.941012 10.91.10.189 -> 114.114.114.114 UDP
57 70 1.947009 192.168.3.56 -> 192.168.3.1 UDP
58 182 1.979996 68:8F:84:EE:DC:E9 -> 00:9A:D2:2D:B9:90 PPPoE Session Stage
59 187 1.981004 192.168.3.1 -> 192.168.3.56 UDP
60 130 1.981004 68:8F:84:EE:DC:E9 -> 00:9A:D2:2D:B9:90 PPPoE Session Stage
61 187 1.982011 192.168.3.1 -> 192.168.3.56 UDP
62 131 1.982011 192.168.3.1 -> 192.168.3.56 UDP
63 98 1.990006 192.168.2.11 -> 224.0.0.251 UDP
64 82 2.018996 10.16.9.1 -> 10.16.9.2 UDP
65 91 2.184048 192.168.2.154 -> 224.0.0.251 UDP
66 77 2.218042 192.168.2.149 -> 192.168.2.1 UDP
67 125 2.221048 192.168.2.1 -> 192.168.2.149 UDP
68 82 2.221048 10.16.9.1 -> 10.16.9.2 UDP
69 145 2.221048 10.0.254.125 -> 10.0.8.15 UDP
70 145 2.221048 10.0.254.125 -> 10.0.8.16 UDP
71 189 2.269035 95:C1:00:00:F2:2F -> 00:21:45:00:00:BB unknown
72 88 2.288046 192.168.2.153 -> 192.168.2.1 UDP
73 163 2.288046 192.168.2.1 -> 192.168.2.153 UDP
74 88 2.289038 192.168.2.153 -> 224.0.0.251 UDP
75 70 2.294043 192.168.2.153 -> 192.168.2.1 ICMP
76 82 2.421035 10.16.9.1 -> 10.16.9.2 UDP
77 100 2.434035 04:B9:00:00:F2:2F -> 00:21:45:00:00:62 unknown
78 155 2.504023 192.168.2.149 -> 224.0.0.251 UDP
79 82 2.621022 10.16.9.1 -> 10.16.9.2 UDP
80 74 2.650027 10.16.9.1 -> 224.0.0.10 EIGRP
81 155 2.754010 192.168.2.149 -> 224.0.0.251 UDP
82 82 2.822015 10.16.9.1 -> 10.16.9.2 UDP
83 60 2.882010 38:C9:86:07:37:19 -> FF:FF:FF:FF:FF:FF ARP
84 94 2.885015 192.168.2.163 -> 224.0.0.251 UDP
85 74 2.954012 10.16.9.1 -> 224.0.0.10 EIGRP
86 155 3.011001 192.168.2.149 -> 224.0.0.251 UDP
87 82 3.022002 10.16.9.1 -> 10.16.9.2 UDP
88 82 3.222040 10.16.9.1 -> 10.16.9.2 UDP
89 82 3.222040 10.16.9.1 -> 10.16.9.2 UDP
90 60 3.222040 00:9A:D2:2D:BA:10 -> FF:FF:FF:FF:FF:FF ARP
91 382 3.265037 192.168.2.149 -> 224.0.0.251 UDP
92 82 3.421035 10.16.9.1 -> 10.16.9.2 UDP
93 56 3.566032 F0:18:98:A5:1E:6C -> 00:9A:D2:2D:BA:14 ARP
94 60 3.567023 00:9A:D2:2D:BA:14 -> F0:18:98:A5:1E:6C ARP
95 74 3.615025 10.0.254.125 -> 224.0.0.10 EIGRP
96 74 3.615025 10.0.254.125 -> 224.0.0.10 EIGRP
97 82 3.621022 10.16.9.1 -> 10.16.9.2 UDP
98 60 3.644015 00:9A:D2:2D:B9:90 -> 68:8F:84:EE:DC:E9 PPPoE Session Stage
99 82 3.823007 10.16.9.1 -> 10.16.9.2 UDP
简单看一下前3分报文的detail：
CDXY-449295-R01#show monitor capture A buffer detailed
-------------------------------------------------------------
# size timestamp source destination protocol
-------------------------------------------------------------
0 220 0.000000 192.168.2.149 -> 224.0.0.251 UDP
0000: 01005E00 00FB989E 633099A4 08004500 ..^.....c0....E.
0010: 00CEA794 0000FF11 6F51C0A8 0295E000 ........oQ......
0020: 00FB14E9 14E900BA FA4B0000 00000009 .........K......
0030: 00000000 0001085F 7363616E 6E657204 ......._scanner.
1 82 0.016997 10.16.9.1 -> 10.16.9.2 UDP
0000: 00000000 00000000 00000000 08004500 ..............E.
0010: 00444D29 0000FF11 485D0A10 09010A10 .DM)....H]......
0020: 0902169B 169B0030 E3220001 00010002 .......0."......
0030: 00280000 00010000 00005BEE 46BB0000 .(........[.F...
2 70 0.098054 94:C3:00:00:F2:2F -> 00:21:45:00:00:44 unknown
0000: 00214500 004494C3 0000F22F FDD52BF0 .!E..D...../..+.
0010: F4E90A5B 0ABD2000 08000001 E2404500 ...[.. ......@E.
0020: 00286C44 40003F06 A7710A00 0B0A0A10 .(lD@.?..q......
0030: 0901E3E2 0016FF84 FD094316 2CAB5010 ..........C.,.P.
当完成100个报文的抓取，此时EPC会自动停止了：
R01#sho monitor capture A
Status Information for Capture A
Target Type:
Interface: Control Plane, Direction : both
Status : Inactive
Filter Details:
Capture all packets
Buffer Details:
Buffer Type: LINEAR (default)
Buffer Size (in MB): 10
Limit Details:
Number of Packets to capture: 100
Packet Capture duration: 0 (no limit)
Packet Size to capture: 0 (no limit)
Maximum number of packets to capture per second: 1000
Packet sampling rate: 0 (no sampling)
我们可以一条命令指定：
R01#monitor capture A match ipv4 protocol tcp any any control-plane both limit packets 100 buffer size 10 circular interface GigabitEthernet 0/0/0
解释：配置EPC的名字为A，匹配ipv4的TCP协议，针对接口G0/0/0，源是any，目的也是any，抓取的是控制层面进出的报文，报文数量为100个，存储报文的的空间大小为10MB，采取当buffer满了时，丢掉旧报文的方式。
ISR4K-IOS XE EPC的更多相关文章
- Cisco IOS和IOS XE 新漏洞检测与修复
Cisco IOS/IOS XE 新漏洞检测与修复 CVE-2018-0150 Cisco IOS XE 存在默认弱口令 漏洞影响: 默认弱口令可以导致攻击者直远程登录控制Cisco设备.受影响版本, ...
- 为什么ISR4K、ASR1K等设备的QoS ACL没有显示计数？
思科的ISR4K和ASR1K设备都是IOS XE的架构,它们和传统的IOS架构是不一样的. 以ISR4K为例,和一般的IOS(例如ISR G2)有所区别,他的转发更依赖硬件完成,针对NAT或QoS应用 ...
- Embedded Packet Capture (EPC)
Embedded Packet Capture (EPC)是一个很好的抓包工具,在排障的时候,需要在线抓包的情况下,是一个非常好的选择. EPC在IOS和IOS-XE都是支持,不过,不同平台下有版本的 ...
- IOS XE-show memory
有些时候,我们可能会遇到IOS XE设备的high memory的情况.我们可以使用的命令去查看相关信息. 例如: Router# show version Router# show memory R ...
- 开源一个监控数据采集Agent：OpenFalcon-SuitAgent
OpenFalcon-SuitAgent 项目地址:github 版本说明 本系统版本划分如下 alpha:内部测试版(不建议使用于生产环境) beta:公开测试版(不建议使用于生产环境) final ...
- 开源流量分析系统 Apache Spot 概述(转)
原文地址http://blog.nsfocus.net/apache-spot/ Apache Spot 是一个基于网络流量和数据包分析,通过独特的机器学习方法,发现潜在安全威胁和未知网络攻击能力的开 ...
- IPSec无法建立？注意第一阶段hash sha !
该篇注意记录一下,有些情况下,我们配置了IPSec ,但是就是无法建立,发现连第一阶段都无法建立起来. 1.检查配置无问题 2.开启debug crypto isakmp发现有IKE的重传 3.sho ...
- SPAN, RSPAN, ERSPAN
该文档摘自:Home > CCIE Routing and Switching Study Group > Discussions 由 Deben 于 2015-2-6 上午6:50 创建 ...
- 思科Catalyst 9K
思科的新一代产品Catalyst9K,里面涉及了Catalyst9200.Catalyst9300.Catalyst9400.Catalyst9500.Catalyst9600和Catalyst980 ...
随机推荐
- P2141珠心算测验题解
先来看一下题目:某学校的珠心算老师采用一种快速考察珠心算加法能力的测验方法.他随机生成一个正整数集合,集合中的数各不相同,然后要求学生回答:其中有多少个数,恰好等于集合中另外两个(不同的)数之和? 这 ...
- multiprocessing 多进程实现 生产者与消费者模型JoinableQueue
from multiprocessing import JoinableQueue import time import random import asyncio import logging fr ...
- 微信小程序实例test
index.js //index.js //获取应用实例 const app = getApp() var pageConfig = { data: { motto: 'Hello World', u ...
- web前端-基础篇
该篇仅是本人学习前端时,做的备忘笔记: 一.背景图片设置: 设置背景图时的css代码:background-image:url(图片的url路径); ps:设置好这个背景后请一定要设置该背景图片的大小 ...
- 直方图histeq
histeq的原理: [MN]=size(H); [counts,x]=imhist(H);%H是读取的图像,imhist是对图像直方图进行统计,其中count,是每个灰度值得个数,x代表灰度值.一般 ...
- linux下安装keepalived
keepalived安装文档 1. 安装环境 su - root yum -y install kernel-devel* yum -y install openssl-* yum -y instal ...
- 线段树+扫描线 NAIPC 2019 Intersecting Rectangles
你看看你有多菜,一点线段树的小小的运用,就不会写了: 题意:如果矩阵有交集,输出1,否则输出0(不包含内嵌): 思路:本题求交集,还得不包括内嵌的情况: 做过一道是求面积的题.跟这道类似,但在这里定义 ...
- docker 报错 docker: Error response from daemon: driver failed....iptables failed:
现象: [root@localhost test]# docker run --name postgres1 -e POSTGRES_PASSWORD=password -p : -d postgre ...
- 前端——语言——Core JS——《The good part》读书笔记——第九,十章节(Style，Good Features)
第九章节 本章节不再介绍知识点,而是作者在提倡大家培养良好的编码习惯,使用Good parts of JS,避免Bad parts of JS.它是一篇文章. 本文的1-3段阐述应用在开发过程中总会遇 ...
- 使用Canvas画布的注意事项
1.开始一个路径时要使用beiginPath()方法 ,不然会发生意想不到的事件. 2.图片加载完成后才能按照顺序依次绘图 (巧用onload时间)