Configuring a PCAP Mirroring Service

The following steps outline how to configure, start, stop, and restart a PCAP mirroring service.

1. Configure the mirror destination using the config>mirror>mirror-dest command. Include the PCAP file URL and session name. Only remote URL locations are supported.

2. (Optionally) Configure the number of packets to be captured using the capture-count command.

3. Configure the mirror source using the debug>mirror-source command.

   The 7705 SAR waits for the debug>mirror-source command to begin mirroring.

4. Start the packet capture by issuing the debug>pcap>capture start command. The FTP process begins as soon as the start command is issued.

5. Stop the packet capture using one of the following methods:

   • automatic stop

     The system automatically stops after the configured number of capture-count packets or the maximum number of packets have been captured.

   • manual stop

     Use the debug>pcap>capture stop command to stop capturing packets and clear the buffer. The FTP session stops.

6. (Optionally) Restart the packet capture by reissuing the capture start command.

   The new packet capture file overwrites the existing file. To separate the capture files, either configure a new mirror destination URL or rename the existing file on the FTP server.

Use the following CLI syntax to create and start a PCAP mirroring service.

CLI Syntax:

config>mirror# mirror-dest service-id create
    pcap session-name [create] 
        file-url file-url
        capture-count packet-num

CLI Syntax:

debug
    mirror-source service-id 
        mac-filter mac-filter-id entry entry-id [entry-id ...] 
        port {port-id | lag lag-id} {[egress] [ingress]} 
        [no] shutdown 

CLI Syntax:

debug
    pcap session-name 
        capture {start | stop} 

The following example shows a PCAP mirror destination configuration to the remote node:

*A:SAR-1>config>mirror# info
----------------------------------------------
        mirror-dest 103 create
            pcap PCAP_test create
                file-url ftp:login:pswd@remote-locn/file-path
                capture-count 100
                exit
            exit
        exit
----------------------------------------------
*A:SAR-1>config>mirror# 

The following example shows a mirror source configuration:

*A:SAR-1>show debug mirror
debug
    mirror-source 103
        port 1/1/2 egress ingress
            no shutdown
        exit
    exit
*A:SAR-1>debug>mirror-source# exit

The following example shows the start of packet capture:

*A:SAR-1>debug>pcap PCAP_test# 
    capture start
    exit
*A:SAR-1>debug>pcap