Capturing Traffic with TCPdump

This section provides instructions for capturing the traffic that passes through the 100G Ports.

Notes:

  • For information about the available TCPdump "<options>", see https://www.tcpdump.org/manpages/tcpdump.1.html.

  • To capture traffic on a VLAN interface that is configured on a 100G Port, you must specify the VLAN ID in the TCPdump syntax.

    Example for capturing TCP traffic on VLAN 200 configured on port eth1-01:

    tcpdump -i eth1-01 vlan 200 and tcp

  • When you capture traffic on a Bond interface that is configured on 100G Ports, you cannot see the traffic accelerated from the 100G Ports.

    To see the accelerated traffic, you must run the TCPdump directly on the 100G Ports.

    Example:

    If bond2 consists of the 100G Ports eth1-01 and eth1-02, then to see the accelerated traffic, run:

    tcpdump -i eth1-01 <options>

    tcpdump -i eth1-02 <options>

  • The TCPdump option "-Q {in | out | inout}" is not supported on the 100G Ports.

Capturing Only the Accelerated Traffic

You can capture only the traffic that is accelerated in 100G Ports.

Step

Instructions

1

Connect to the command line on the Security Gateway.

2

Log in to the Expert mode.

3

Run:

tcpdump [<options>] -i <Name of 100G Port> [<options>]

Capturing Only the Non-Accelerated Traffic

You can capture only the non-accelerated traffic that is forwarded to the host appliance.

Step

Instructions

1

Connect to the command line on the Security Gateway.

2

Log in to the Expert mode.

3

Run:

tcpdump [<options>] -i <Name of 100G Port> --host-only [<options>]

Capturing Only the Accelerated VLAN Traffic

You can capture only the traffic with VLAN tags that is accelerated in 100G Ports.

Step

Instructions

1

Connect to the command line on the Security Gateway.

2

Log in to the Expert mode.

3

Run:

tcpdump [<options>] -i <Name of 100G Port> vlan <VLAN ID> [<options>]

Example for eth1-01.200 (VLAN 200 on eth1-01):

tcpdump [<options>] -i eth1-01 vlan 200 [<options>]

Capturing Accelerated Traffic Without RoCE Packets

Traffic capture on 100G Ports may also show the RoCE (RDMA over Converged Ethernet) packets.

You can exclude these RoCE packets from the traffic capture.

Step

Instructions

1

Connect to the command line on the Security Gateway.

2

Log in to the Expert mode.

3

Run:

tcpdump [<options>] -i <Name of 100G Port> ether proto not 0x8915 [<options>]