Local Text-Based Capture; Remote Capture Daemon; Gui-Based Client; Configuring The Cisco Fabric Analyzer - HP Cisco MDS 9020 - Fabric Switch Configuration Manual

Cisco Fabric Analyzer
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m

Local Text-Based Capture

This component is a command-line driven text-based interface that captures traffic to and from the
supervisor module in a Cisco MDS 9000 Family switch. It is a fully functional decoder that is useful for
quick debug purposes or for use when the remote capture daemon is not enabled. Additionally, because
this tool is accessed from within the Cisco MDS 9000 Family switch, it is protected by the roles-based
policy that limits access in each switch.
See the

Remote Capture Daemon

This daemon is the server end of the remote capture component. The Ethereal analyzer running on a host
is the client end. They communicate with each other using the Remote Capture Protocol (RPCAP).
RPCAP uses two endpoints, a TCP-based control connection and a TCP or UDP-based data connection
based on TCP (default) or UDP. The control connection is used to remotely control the captures (start or
stop the capture, or specify capture filters). Remote capture can only be performed to explicitly
configured hosts. This technique prevents an unauthorized machine in the network from snooping on the
control traffic in the network.
RPCAP supports two setup connection modes based on firewall restrictions.
•
•
Using capture filters, you can limit the amount of traffic that is actually sent to the client. Capture filters
are specified at the client end—on Ethereal, not on the switch.
See the

GUI-Based Client

The Ethereal software runs on a host, such as a PC or workstation, and communicates with the remote
capture daemon. This software is available in the public domain from http://www.ethereal.com. The
Ethereal GUI front-end supports a rich interface such as a colorized display, graphical assists in defining
filters, and specific frame searches. These features are documented on Ethereal's web site.
While remote capture through Ethereal supports capturing and decoding Fibre Channel frames from a
Cisco MDS 9000 Family switch, the host running Ethereal does not require a Fibre Channel connection
to the switch. The remote capture daemon running on the switch sends the captured frames over the
out-of-band Ethernet management port. This capability allows you to capture and decode Fibre Channel
frames from your desktop or laptop.
See the

Configuring the Cisco Fabric Analyzer

You can configure the Cisco Fabric Analyzer to perform one of two captures.
•
Cisco MDS 9000 Family CLI Configuration Guide
58-6
"Capturing Frames Locally" section on page
Passive mode (default)—The configured host initiates connection to the switch. Multiple hosts can
be configured to be in passive mode and multiple hosts can be connected and receive remote captures
at the same time.
Active mode—The switch initiates the connection to a configured host—one host at a time.
"Sending Captures to Remote IP Addresses" section on page
"Displaying Captured Frames" section on page
Local capture—The command setting to enable a local capture cannot be saved to persistent storage
or synchronized to standby. Launches the textual version on the fabric analyzer directly on the
console screen. The capture can also be saved on the local file system.
Chapter 58 Troubleshooting Your Fabric
58-7.
58-8.
58-9.
OL-16184-01, Cisco MDS SAN-OS Release 3.x