Forum Discussion

a_basharat_2591's avatar
a_basharat_2591
Icon for Nimbostratus rankNimbostratus
Jun 15, 2017

Wireshark capture on a LACP trunk channel

Hi,

 

Two of my physical BIG-IP interfaces [2.1 and 2.2] have been configured as a portchannel, How can I get a capture of the traffic going through that port channel?

 

For one single interface I use the following command: tcpdump -i 2.1 -s 65535 -w destination_file

 

What would be the command or procedure to get the traffic for 2.1 and 2.2 as LACP trunk interface?

 

Thanks

 

application delivery
BIG-IP
devops
LTM
  • Ed_Summers's avatar
    Ed_Summers
    Icon for Nimbostratus rankNimbostratus
    Jun 15, 2017

    Have you seen: K6546: Recommended methods and limitations for running tcpdump on a BIG-IP system

    From the article: If the specified interface is a member of a trunk, tcpdump captures all traffic flowing through the trunk, not just the traffic traversing the specified interface.

    Beware of the rate limitations when capturing traffic on a hardware interface.

    I didn't see in the article, but you can run the following to get a list of interfaces available for capture

    tcpdump -D