From a VDOM, you can use the
diagnose sniffer packet command to view or sniff packets as they are processed by FIM or FPMs for that VDOM. To use this command you have to be logged into a VDOM. You can run this command from any FIM or FPM CLI.
The command output includes the address of the slot containing the module that processed the packet. From the primary FIM, you can see packets processed by all of the FIMs and FPMs. From individual FIMs or FPMs you can see packets processed by that FIM or FPM.
From the primary FIM, you can enter the
diagnose sniffer options slot currrent command to only see packets processed by the primary FIM. You can also enter the
diagnose sniffer options slot default command to see packets processed by all modules.
The command syntax is:
diagnose sniffer packet <interface> <protocol-filter> <verbose> <count> <timestamp> <slot>
<interface> is the name of one or more interfaces on which to sniff for packets. Use
any to sniff packets for all interfaces. To view management traffic use the
elbc-base-ctrl interface name.
<protocol-filter> a filter to select the protocol for which to view traffic. This can be simple, such as entering
udp to view UDP traffic or complex to specify a protocol, port, and source and destination interface and so on.
<verbose> the amount of detail in the output, and can be:
- display packet headers only.
- display packet headers and IP data.
- display packet headers and Ethernet data (if available).
- display packet headers and interface names.
- display packet headers, IP data, and interface names.
- display packet headers, Ethernet data (if available), and interface names.
<count> the number of packets to view. You can enter Ctrl-C to stop the sniffer before the count is reached.
<timestamp> the timestamp format,
a for UTC time and
l for local time.
[FPM04] 1.598890 3ffe:1:1:4::97b.13344 -> 3ffe:1:2:4::105.25: syn 151843506 [FPM03] 1.214394 802.1Q vlan#4022 P0 3ffe:1:1:2::214.10012 -> 3ffe:1:2:2::103.53: udp 30 [FIM02] 2.177930 llc unnumbered, 23, flags [poll], length 40 [FIM01] 1.583778 172.30.248.99.57167 -> 10.160.19.70.443: ack 2403720303 [FPM04] 1.598891 184.108.40.206.14471 -> 220.127.116.11.143: syn 2715027438 ^C [FPM03] 1.214395 3ffe:1:1:2::214.10012 -> 3ffe:1:2:2::103.53: udp 30 [FIM01] 1.583779 172.30.248.99.57167 -> 10.160.19.70.443: ack 2403720303