Nexus 9000:Packet Tracer工具說明
簡介
Packet Tracer是Nexus 9000上的內建實用程式，可用於跟蹤資料包通過交換機的路徑。它可以使用命令列呼叫，並且可以配置為匹配IP地址和/或第4層屬性。它不能用於匹配ARP流量。
此工具將確認流是否正在通過交換機。它還提供了跟蹤流量統計資料的計數器，這對出現間歇性/完全資料包丟失的情況非常有用。
必要條件
需求
思科建議您瞭解以下主題的基本知識：
- Cisco Nexus 9000硬體架構
採用元件
本文中的資訊係根據以下軟體和硬體版本：
- Cisco Nexus 9500
- 軟體版本7.0(3)I2(2a)
用例場景
- 僅適用於IPv4流（不支援IPv6和非IP）
- 此工具不顯示wireshark所示的資料包內部詳細資訊。
- 間歇性丟包：Ping或任何其他實用程式都可以提供丟失資料包的確切症狀
- 完整資料包丟失
支援的硬體
僅支援帶有Broadcom Trident II asic的線卡/交換矩陣模組或TOR。清單如下：
- N9K-C9372TX
- N9K-C9372PX
- N9K-C9332PQ
- N9K-C9396TX
- N9K-C9396PX
- N9K-C93128TX
- N9K-C9336PQ
- N9K-X9564PX
- N9K-X9564TX
- N9K-X9636PQ
不支援的硬體
- N9K-C93180YC-EX
- N9K-X9732C-EX
- N9K-C9232C
- N9k-C9272Q
- N9k-C92160YC
附註：如果未列出特定線路卡/TOR，請聯絡TAC
如何使用Packet Tracer
組態
Packet Tracer命令是執行級命令。
N9K-9508#test packet-tracer src_ip <src_ip> dst_ip <dst_ip> <==== provide your src and dst ip
N9K-9508#test packet-tracer start <==== Start packet tracer
N9K-9508#test packet-tracer stop <==== Start packet tracer
N9K-9508#test packet-tracer show <==== Check for packet matches
上述命令可對線卡或交換矩陣模組上存在的每個Broadcom Trident II Asic上的觸發器進行程式設計。當具有匹配屬性的流經過這些模組時，它將顯示所命中的計數器，從而幫助標識交換機內的路徑(入口模組 — >結構模組之一---->出口模組)。
計數器可用於關聯丟包。
背景資訊
交換矩陣模組互連I/O模組插槽。所有交換矩陣模組都處於活動狀態並傳輸流量。每個交換矩陣模組兩個Broadcom Trident II ASIC(T2)例項。
問題
PACL(Port Access-list)用於檢視特定實體介面是否收到我們所感興趣的流量。但是在Nexus平台上，有些線卡沒有為PACL雕刻的TCAM。TCAM雕刻需要重新載入模組。在這些情況下，使用Packet Tracer匹配感興趣的流量。您還可以追蹤前往光纖連線埠和前往輸出模組的封包。因此，Packet Tracer可以讓您更深入地瞭解流量在交換機中的轉發方式。
Packet tracer使用為SPAN燒錄的TCAM條目。
解決方案
NS — 北星ASIC
T2 - Trident II ASIC
NFE — 網路轉發引擎
ALE - ACI枝葉引擎
有關Nexus 9000交換機架構的詳細資訊，請參閱：
附註：
使用案例: 匹配入口模組上的流量、交換矩陣模組上的流量入口和出口模組上的流量入口T2 ASIC
以下是需要配置以匹配感興趣流量的基本步驟：
switch#test packet-tracer {<src-ip>|<dst-ip>|<src-l4-port>|<dst-l4-port>} [<protocol>] [detail-fp|detail-hg]
以下是您需要的設定：
switch#test packet-tracer src_ip
dst_ip
protocol <>
<==== provide your src and dst ip and protocol (protocol option 1 is for icmp)
switch#test packet-tracer start
<==== Start packet tracer
switch#test packet-tracer show
<==== Check for packet match statistics
您無需將其應用於任何特定介面。上面的配置在T2 ASIC的所有例項上的所有LC/FM上安裝過濾器ACL。
它將顯示流量進入的模組上的資料包計數。這與我們在模組（線卡和交換矩陣）上接收的有關流量相匹配。
以下是組態範例：
N9K-9508# test packet-tracer src-ip 10.1.1.1 dst-ip 10.2.2.1 protocol 1 <=== Protocol 1 matches ICMP traffic
N9K-9508# test packet-tracer start
以下是如何解釋「test packet tracer show」輸出：
N9K-9508# test packet-tracer show
Packet-tracer stats
---------------------
Module 1: <=== Slot #. Same output will be displayed for other Linecards's and Fabric modules.
Filter 1 installed: src-ip 10.1.1.1 dst-ip 10.2.2.1 <==== Our filter #1
ASIC instance 0: <==== Trident ASIC instance #0
Entry 0: id = 7425, count = 0, active, fp, <==== pakcet match count on front panel port. it could be any port
Entry 1: id = 7426, count = 0, active, hg, <==== packet match count from fabric module to T2 ASIC on the linecard
ASIC instance 1:
Entry 0: id = 7425, count = 0, active, fp,
Entry 1: id = 7426, count = 0, active, hg,
Filter 2 uninstalled:
Filter 3 uninstalled:
Filter 4 uninstalled:
Filter 5 uninstalled:
配置示例：
配置Packet Tracer:
N9K-9508# test packet-tracer src-ip 10.1.1.1 dst-ip 10.2.2.1 protocol 1 <==== Filter to match echo traffic. Protocol 1 to match icmp traffic
N9K-9508# test packet-tracer src-ip 10.2.2.1 dst-ip 10.1.1.1 protocol 1 <=== Filter to match echo reply traffic
N9K-9508# test packet-tracer start <==== Start packet tracer
N9K-9508# test packet-tracer show non-zero <==== Command to see packet statistics
Packet-tracer stats
---------------------
Module 1:
Filter 1 installed: src-ip 10.1.1.1 dst-ip 10.2.2.1
Filter 2 installed: src-ip 10.2.2.1 dst-ip 10.1.1.1
Filter 3 uninstalled:
Filter 4 uninstalled:
Filter 5 uninstalled:
Module 2:
Filter 1 installed: src-ip 10.1.1.1 dst-ip 10.2.2.1
Filter 2 installed: src-ip 10.2.2.1 dst-ip 10.1.1.1
Filter 3 uninstalled:
Filter 4 uninstalled:
Filter 5 uninstalled:
Module 22:
Filter 1 installed: src-ip 10.1.1.1 dst-ip 10.2.2.1
Filter 2 installed: src-ip 10.2.2.1 dst-ip 10.1.1.1
Filter 3 uninstalled:
Filter 4 uninstalled:
Filter 5 uninstalled:
Module 23:
Filter 1 installed: src-ip 10.1.1.1 dst-ip 10.2.2.1
Filter 2 installed: src-ip 10.2.2.1 dst-ip 10.1.1.1
Filter 3 uninstalled:
Filter 4 uninstalled:
Filter 5 uninstalled:
Module 24:
Filter 1 installed: src-ip 10.1.1.1 dst-ip 10.2.2.1
Filter 2 installed: src-ip 10.2.2.1 dst-ip 10.1.1.1
Filter 3 uninstalled:
Filter 4 uninstalled:
Filter 5 uninstalled:
Module 25:
Filter 1 installed: src-ip 10.1.1.1 dst-ip 10.2.2.1
Filter 2 installed: src-ip 10.2.2.1 dst-ip 10.1.1.1
Filter 3 uninstalled:
Filter 4 uninstalled:
Filter 5 uninstalled:
測試:從模組1的SRC IP對模組2的DST IP運行ping:
Router# ping 10.1.1.1 source 10.2.2.1
PING 10.1.1.1 (10.1.1.1) from 10.2.2.1: 56 data bytes
64 bytes from 10.1.1.1: icmp_seq=0 ttl=253 time=0.77 ms
64 bytes from 10.1.1.1: icmp_seq=1 ttl=253 time=0.43 ms
64 bytes from 10.1.1.1: icmp_seq=2 ttl=253 time=0.408 ms
64 bytes from 10.1.1.1: icmp_seq=3 ttl=253 time=0.398 ms
64 bytes from 10.1.1.1: icmp_seq=4 ttl=253 time=0.383 ms
--- 10.1.1.1 ping statistics ---
5 packets transmitted, 5 packets received, 0.00% packet loss
round-trip min/avg/max = 0.383/0.477/0.77 ms
驗證:檢查Packet Tracer計數：
N9K-9508# test packet-tracer show non-zero <==== Command to see packet statistics
Packet-tracer stats
---------------------
Module 1:
Filter 1 installed: src-ip 10.1.1.1 dst-ip 10.2.2.1 protocol 1
ASIC instance 0:
Entry 0: id = 7425, count = 5, active, fp, <===== 5 Echo packets ingress on Module 1
Filter 2 installed: src-ip 10.2.2.1 dst-ip 10.1.1.1 protocol 1
Filter 3 uninstalled:
Filter 4 uninstalled:
Filter 5 uninstalled:
Module 2:
Filter 1 installed: src-ip 10.1.1.1 dst-ip 10.2.2.1 protocol 1
Filter 2 installed: src-ip 10.2.2.1 dst-ip 10.1.1.1 protocol 1
ASIC instance 0:
Entry 0: id = 7457, count = 5, active, fp, <===== 5 Echo reply packets ingress on Module 2
Filter 3 uninstalled:
Filter 4 uninstalled:
Filter 5 uninstalled:
Module 3:
Filter 1 installed: src-ip 10.1.1.1 dst-ip 10.2.2.1 protocol 1
Filter 2 installed: src-ip 10.2.2.1 dst-ip 10.1.1.1 protocol 1
Filter 3 uninstalled:
Filter 4 uninstalled:
Filter 5 uninstalled:
Module 4:
Filter 1 installed: src-ip 10.1.1.1 dst-ip 10.2.2.1 protocol 1
Filter 2 installed: src-ip 10.2.2.1 dst-ip 10.1.1.1 protocol 1
Filter 3 uninstalled:
Filter 4 uninstalled:
Filter 5 uninstalled:
Module 22:
Filter 1 installed: src-ip 10.1.1.1 dst-ip 10.2.2.1 protocol 1
ASIC instance 0:
Entry 0: id = 7425, count = 4, active, hg, <==== Fabric module 22 received 4 echo packets
Filter 2 installed: src-ip 10.2.2.1 dst-ip 10.1.1.1 protocol 1
Filter 3 uninstalled:
Filter 4 uninstalled:
Filter 5 uninstalled:
Module 23:
Filter 1 installed: src-ip 10.1.1.1 dst-ip 10.2.2.1 protocol 1
ASIC instance 0:
Entry 0: id = 7425, count = 1, active, hg, <==== Fabric module 23 received 1 echo packets
Filter 2 installed: src-ip 10.2.2.1 dst-ip 10.1.1.1 protocol 1
ASIC instance 0:
Entry 0: id = 7425, count = 3, active, hg, <==== Fabric module 23 received 3 echo reply packets
Filter 3 uninstalled:
Filter 4 uninstalled:
Filter 5 uninstalled:
Module 24:
Filter 1 installed: src-ip 10.1.1.1 dst-ip 10.2.2.1 protocol 1
Filter 2 installed: src-ip 10.2.2.1 dst-ip 10.1.1.1 protocol 1
ASIC instance 0:
Entry 0: id = 7425, count = 2, active, hg, <==== Fabric module 23 received 2 echo reply packets
Filter 3 uninstalled:
Filter 4 uninstalled:
Filter 5 uninstalled:
Module 26:
Filter 1 installed: src-ip 10.1.1.1 dst-ip 10.2.2.1 protocol 1
Filter 2 installed: src-ip 10.2.2.1 dst-ip 10.1.1.1 protocol 1
Filter 3 uninstalled:
Filter 4 uninstalled:
Filter 5 uninstalled:
N9K-9508#
其他有用的命令：
test packet tracer remove-all <===移除所有已配置的過濾器
測試packet tracer clear <filter #> <清除所===過濾器或指定過濾器的計數器
測試packet tracer src_ip <.> dst_ip <> l4-dst-port <dst_port> | l4-src-port <src_port> | protocol <===根據L4 src_port、L4 dst_port或協定進行匹配。
意見