Remote Capture Daemon; Gui-Based Client; Configuring The Cisco Fabric Analyzer - Cisco DS-C9216I-K9 Configuration Manual

Configuring a Fabric Analyzer

Remote Capture Daemon

This daemon is the server end of the remote capture component. The Ethereal analyzer running on a host
is the client end. They communicate with each other using the Remote Capture Protocol (RPCAP).
RPCAP uses two end points, a TCP-based control connection and a TCP or UDP-based data connection
based on TCP (default) or UDP. The control connection is used to remotely control the captures (start or
stop the capture, or specify capture filters). Remote capture can only be performed to explicitly
configured hosts. This technique prevents unauthorized machine in the network from snooping on the
control traffic in the network.
RPCAP supports two setup connection modes based on fire wall restrictions.
•
•
Using capture filters, you can limit the amount of traffic that is actually sent to the client. Capture filters
are specified at the client end--on Ethereal, not on the switch.

GUI-Based Client

The Ethereal software runs on a host, such as a PC or workstation, and communicates with the remote
capture daemon. This software is available in the public domain from http://www.ethereal.com. Since
Ethereal has a GUI front-end, it supports a rich functionality such as colorized display, graphical assists
in defining filters, and searching for specific frames. These features are documented on the Ethereal web
site.
While remote capture via Ethereal supports capturing and decoding Fibre Channel frames from a Cisco
MDS 9000 Family switch, the host running Ethereal does not require a Fibre Channel connection to the
switch. The remote capture daemon running on the switch sends the captured frames over the
out-of-band Ethernet management port. This capability allows you to capture and decode Fibre Channel
frames from your desktop or laptop.

Configuring the Cisco Fabric Analyzer

You can configure the Cisco Fabric Analyzer by issuing the fcanalyzer local or fcanalyzer remote
commands in configuration mode.
•
•
To use the Cisco Fabric Analyzer feature, traffic should be flowing to or from the supervisor module.
Cisco MDS 9000 Fabric Manager Switch Configuration Guide
31-4
Passive mode (default)—The configured host initiates connection to the switch. Multiple hosts can
be configured to be in passive mode and multiple hosts can be connected and receive remote
captures at the same time.
Active mode—The switch initiates the connection to a configured host--one host at a time.
Local capture—The command setting to enable a local capture cannot be saved to persistent storage
or synchronized to standby.
Remote capture—The command setting to enable a remote capture can be saved to persistent storage
using the copy command. It can be synchronized to the standby supervisor module and a stateless
restart can be issued, if required.
Chapter 31 Advanced Features and Concepts
OL-7753-01