AOS-CX Packet capture with filters

Sometimes we will be required to capture only certain traffic and to limit unnecessary noise and traffic in our packet capture.

In the next post i will explain how to configure a packet capture with filters on Aruba AOS-CX.

First we will configure a class for the specific traffic, in this example ICMP:

class ip icmp
vsx-sync
!
10 match icmp any any

Then configure a policy to redirect the captured traffic to mirror session 1:

policy mirror
vsx-sync
!
10 class ip icmp action mirror 1

Apply the policy on the required interface:

interface lag 2 multi-chassis
no shutdown
no routing
vlan trunk native 1
vlan trunk allowed all
lacp mode active
apply policy mirror in

Configure a mirror session:

mirror session 1
destination cpu
enable

Either run Tshark on the operational context:

diagnostics 
diag utilities tshark

Or enter the shell and run tcpdump:

start-shell 
sudo bash
ip netns exec mirror_ns bash
tcpdump -nnei MirrorRxNet