Why the Eth-OAM Link Fault packets cannot be captured

2

The Eth-OAM packets are sent to the CPU, so the port mirroring or flow mirroring function cannot capture Link Fault packets. To capture the Eth-OAM Link Fault packets, mirror the packets in the CPU to the related observing ports first.

Other related questions:
Can EFM OAM be associated with an Eth-Trunk
EFM OAM cannot be associated with an Eth-Trunk. EFM OAM can be associated with an interface.

S series switch packets capture
S series switches (except S1700 switches) support the packet capturing function. This function can be used if you need to capture packets for analysis. Packets that can be captured include service packets and packets sent to the CPU. Configuration example: 1. Capturing service packets [HUAWEI] capture-packet interface gigabitethernet 1/0/1 destination file capture.cap terminal //Information of captured packets is not provided here. 2. Capturing packets sent to the CPU [HUAWEI] capture-packet cpu destination file cfcard:/abc.cap //Information of captured packets is not provided here.

Method used to view packet loss information if packets cannot be captured on interfaces
If you cannot capture packets on firewall interfaces but you want to view packet loss information, you can use the quintuple packet capture statistics function. The operation is as follows: 1. Create an ACL. [system] acl 3999 [system-acl-adv-3999] rule 5 permit icmp source 10.2.4.2 0 destination 10.2.2.2 0 [system] diagnose [system-diagnose] firewall statistic acl 3999 enable 3. View quintuple packet capture statistics information. system-view [sysname] diagnose [sysname-diagnose] display firewall statistics acl ******************************************************************************** * Summary of ACL-based packet statistics * ******************************************************************************** SLOT 1 CPU 1 RcvnFrag RcvFrag Forward DisnFrag DisFrag Obverse(pkts) : 100 0 95 0 0 Reverse(pkts) : 100 0 100 0 0 SLOT 1 CPU 3 RcvnFrag RcvFrag Forward DisnFrag DisFrag Obverse(pkts) : 2 0 2 0 0 Reverse(pkts) : 1 0 1 0 0 SLOT: 2 Fastforward Discard Obverse(pkts) : 98 0 Reverse(pkts) : 999 0 Detailed information of discarded packets: ******************************************************************************** * Detailed information of ACL-based packet statistics * ******************************************************************************** Protocol(udp) SourceIp(10.2.4.2) DestinationIp(10.2.2.2) SourcePort(333) DestinationPort(444) VpnIndex(public) RcvnFrag RcvFrag Forward DisnFrag DisFrag Obverse(pkts) : 2 0 2 0 0 Reverse(pkts) : 1 0 1 0 0 Discard detail information: Protocol(udp) SourceIp(10.2.4.2) DestinationIp(10.2.2.2) SourcePort(555) DestinationPort(666) VpnIndex(public) RcvnFrag RcvFrag Forward DisnFrag DisFrag Obverse(pkts) : 100 0 95 5 0 Reverse(pkts) : 100 0 100 0 0 Discard detail information: Packet filter packets discarded: 5 Please check the security policy and whether the interface added to a security zone. 4. After locating the problem, run the undo firewall statistics acl command to disable the quintuple packet statistics function to prevent adverse impact on device performance.

Can mirrored packets be saved
Yes. Run the capture-packet command to configure the packet capturing function. The packets captured can be displayed directly on a terminal or be stored in the storage media of the device.

How do I capture packets of a TE series endpoint?
The method of capturing packets of TE30 is as follows: TE30 has only one network port. To capture packets, switch port mirroring must be performed first and then the Wirshark can be used for packet capture. The method of capturing packets of TE40, TE50, and TE60 is as follows: Log in to the endpoint web interface, choose System Settings > Network > IP > Common Settings and enable the hub network port mode. Then the PC can be connected to the LAN2 network port for packet capture using a tool such as Wirshark.

If you have more questions, you can seek help from following ways:
To iKnow To Live Chat
Scroll to top