For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

kridsana's avatar
kridsana
Icon for Cirrocumulus rankCirrocumulus
Oct 03, 2012

can you help me see this log?

 

Oct 2 10:45:49 local/sccp info bcm56xxd[406]: 012c0012:6: enable port mirror (tcpdump) from 1.2 to CPU.

 

Oct 2 10:45:49 local/sccp info bcm56xxd[406]: 012c0012:6: tcpdump limit: 200 packets per second.

 

Oct 2 10:45:49 local/sccp info bcm56xxd[412]: 012c0012:6: bs_packet_rx (bigcap0000358E) unit=0 FULL!flags(28000000) halt mirror of 1.2

 

Oct 2 10:45:51 local/sccp info bcm56xxd[406]: 012c0012:6: enable port mirror (tcpdump) from 1.2 to CPU.

 

Oct 2 10:45:51 local/sccp info bcm56xxd[406]: 012c0012:6: tcpdump limit: 200 packets per second.

 

Oct 2 10:45:51 local/sccp info bcm56xxd[406]: 012c0012:6: bs_packet_register :: reenablingcpu mirror (bigcap0000358E) delay=2s

 

Oct 2 10:45:51 local/sccp info bcm56xxd[412]: 012c0012:6: bs_packet_rx (bigcap0000358E) unit=0 FULL!flags(28000000) halt mirror of 1.2

 

Oct 2 10:45:54 local/sccp info bcm56xxd[406]: 012c0012:6: enable port mirror (tcpdump) from 1.2 to CPU.

 

Oct 2 10:45:54 local/sccp info bcm56xxd[406]: 012c0012:6: tcpdump limit: 200 packets per second.

 

Oct 2 10:45:54 local/sccp info bcm56xxd[406]: 012c0012:6: bs_packet_register :: reenablingcpu mirror (bigcap0000358E) delay=3s

 

Oct 2 10:45:54 local/sccp info bcm56xxd[412]: 012c0012:6: bs_packet_rx (bigcap0000358E) unit=0 FULL!flags(28000000) halt mirror of 1.2

 

 

What problem happen with this log?

 

 

 

config
design

3 Replies

  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Oct 03, 2012
    i guess you run tcpdump on physical interface, didn't you?

     

     

    Running tcpdump on a switch interface is rate-limited to 200 packets per second. Therefore, if you run tcpdump on an interface that is processing more than 200 packets per second, the captured tcpdump file will not include all of the packets.sol6546: Recommended methods and limitations for running tcpdump on a BIG-IP system

     

    https://support.f5.com/kb/en-us/solutions/public/6000/500/sol6546.html?sr=24293758

     

     

    anyway, what was the problem?
  • kridsana's avatar
    kridsana
    Icon for Cirrocumulus rankCirrocumulus
    Oct 03, 2012
    I think so.

     

     

    and I didn't see problem about traffic.

     

     

    but question is when after stop tcpdump , this log still repeat . don't know why?
  • nitass's avatar
    nitass
    Icon for Employee rankEmployee
    Oct 03, 2012
    but question is when after stop tcpdump , this log still repeat . don't know why?have you checked process e.g. ps command? was there another tcpdump running?