There is a lesser known built in packet capture tool in Nexus OS called Ethanalyzer.
Valid for Nexus models 7k, 6k, 5k, 3k, 1kv
Capturing packets on the data-plane
To capture specific IP flows.
Any traffic that is logged in an interface ACL can then be seen in the ethanalyzer.
- Use wireshark display-filters! This will change what’s displayed.
- Use capture filters to change what is captured
- Command only available from the default VDC.
Use this command to create a pcap
This will save the pcap file to the nexus which you can then use the
copy flash ftp command to move it off the device.
It only runs in the default VDC. If you do not have access to the admin or default VDC you cannot use this command. You can still capture from another VDC by setting an interface ACL and log the traffic you want in the VDC you want. Then you can go to the default VDC and run ethanalyzer to see your traffic.
Understanding wireshark relating to Cisco Catalyst and IOS devices
Using the “monitor capture” command on IOS devices