Forum Discussion
boneyard
MVP
MVPtcpdump and route domains
anyone with some actual experience with tcpdump and route domains?
according to sol i should capture in route domain 0 with -i 0.0 and see traffic from the route domain. but i certainly am missing traffic, specially traffic initiated by APM (for auth).
VernonWellsEmployee
0.0 is the internal interface between the switch plane and the control/management plane, so all traffic not accelerated by hardware should traverse this interface, regardless of route domain. However, tcpdump will discard packets if the rate is sufficiently high (and, in fact, the rate doesn't need to be all that high for it to do so). Are you seeing some of the expected packets, or none of them? If it is some, I'd guess the missing packets are a function of tcpdump's normal behavior.
mikehouse_35079Nimbostratus
have you tried mgmt interface? or are you able to see this traffic in that specific route domain?
- boneyard
thank you vernon.
did some more testing myself and was able to capture fine from route domain 0 in another route domain with tcpdump -nn -i /partion/vlan_interface_name
this was with 11.4.0 on a VE, where my previous test was on a hardware big-ip.
so im kinda doubting what i saw before.