Custom Search

Saturday, May 9, 2015

Capture MPLSoGRE Packet using tcpdump and tshark

Packets are captured from em3 interface of compute node (contrail vrouter)

1)
$sudo tcpdump -ni em3 host 10.140.218.20
tcpdump: WARNING: em3: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on em3, link-type EN10MB (Ethernet), capture size 65535 bytes
00:54:59.402129 IP 10.140.218.19 > 10.140.218.20: GREv0, length 106: MPLS (label 31, exp 0, [S], ttl 64)
    0x0000:  0211 66d9 a36e 02af 39c3 c0bf 0800 4500  ..f..n..9.....E.
    0x0010:  0054 0000 4000 4001 22a0 0b01 0103 0b01  .T..@.@.".......
    0x0020:  0105 0800 75a2 3601 0139 9f40 abe2 0000  ....u.6..9.@....
    0x0030:  0000 0000 0000 0000 0000 0000 0000 0000  ................
    0x0040:  0000 0000 0000 0000 0000 0000 0000 0000  ................
    0x0050:  0000 0000 0000 0000 0000 0000 0000 0000  ................
    0x0060:  0000                                     ..
00:54:59.402344 IP 10.140.218.20 > 10.140.218.19: GREv0, length 106: MPLS (label 30, exp 0, [S], ttl 64)
    0x0000:  02af 39c3 c0bf 0211 66d9 a36e 0800 4500  ..9.....f..n..E.
    0x0010:  0054 27bc 0000 4001 3ae4 0b01 0105 0b01  .T'...@.:.......
    0x0020:  0103 0000 7da2 3601 0139 9f40 abe2 0000  ....}.6..9.@....
    0x0030:  0000 0000 0000 0000 0000 0000 0000 0000  ................
    0x0040:  0000 0000 0000 0000 0000 0000 0000 0000  ................
    0x0050:  0000 0000 0000 0000 0000 0000 0000 0000  ................
    0x0060:  0000           

* Request going from 10.140.218.19 to 10.140.218.20 with label:31
* Reply coming back from 10.140.218.20 to 10.140.218.19 with label:30
2)
$sudo tcpdump -i em3 | grep -i label
tcpdump: WARNING: em3: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on em3, link-type EN10MB (Ethernet), capture size 65535 bytes
00:56:42.414629 IP 10.140.218.19 > 10.140.218.20: GREv0, length 106: MPLS (label 31, exp 0, [S], ttl 64)
00:56:42.414938 IP 10.140.218.20 > 10.140.218.19: GREv0, length 106: MPLS (label 30, exp 0, [S], ttl 64)
00:56:43.414781 IP 10.140.218.19 > 10.140.218.20: GREv0, length 106: MPLS (label 31, exp 0, [S], ttl 64)
00:56:43.415026 IP 10.140.218.20 > 10.140.218.19: GREv0, length 106: MPLS (label 30, exp 0, [S], ttl 64)

* Request going from 10.140.218.19 to 10.140.218.20 with label:31
* Reply coming back from 10.140.218.20 to 10.140.218.19 with label:30

3)
$sudo tshark -V -i em3 host 10.140.218.20
tshark: Lua: Error during loading:
 [string "/usr/share/wireshark/init.lua"]:46: dofile has been disabled due to running Wireshark as superuser. See http://wiki.wireshark.org/CaptureSetup/CapturePrivileges for help in running Wireshark as an unprivileged user.
Running as user "root" and group "root". This could be dangerous.
Capturing on 'em3'
Frame 1: 140 bytes on wire (1120 bits), 140 bytes captured (1120 bits) on interface 0
    Interface id: 0
    Encapsulation type: Ethernet (1)
    Arrival Time: May  9, 2015 01:06:35.491039000 IST
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1431113795.491039000 seconds
    [Time delta from previous captured frame: 0.000000000 seconds]
    [Time delta from previous displayed frame: 0.000000000 seconds]
    [Time since reference or first frame: 0.000000000 seconds]
    Frame Number: 1
    Frame Length: 140 bytes (1120 bits)
    Capture Length: 140 bytes (1120 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:gre:mpls:pwethheuristic:pwethcw:eth:llc:data]
Ethernet II, Src: HewlettP_11:ca:d4 (28:be:a9:66:ab:c4), Dst: HewlettP_11:cd:40 (65:rt:a9:45:ac:70)
    Destination: HewlettP_11:cd:40 (65:rt:a9:45:ac:70)
        Address: HewlettP_11:cd:40 (65:rt:a9:45:ac:70)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source: HewlettP_11:ca:d4 (28:be:a9:66:ab:c4)
        Address: HewlettP_11:ca:d4 (28:be:a9:66:ab:c4)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 10.140.218.19 (10.140.218.19), Dst: 10.140.218.20 (10.140.218.20)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 126
    Identification: 0x0000 (0)
    Flags: 0x00
        0... .... = Reserved bit: Not set
        .0.. .... = Don't fragment: Not set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: GRE (47)
    Header checksum: 0xb111 [validation disabled]
        [Good: False]
        [Bad: False]
    Source: 10.140.218.19 (10.140.218.19)
    Destination: 10.140.218.20 (10.140.218.20)
    [Source GeoIP: Unknown]
    [Destination GeoIP: Unknown]
Generic Routing Encapsulation (MPLS label switched packet)
    Flags and Version: 0x0000
        0... .... .... .... = Checksum Bit: No
        .0.. .... .... .... = Routing Bit: No
        ..0. .... .... .... = Key Bit: No
        ...0 .... .... .... = Sequence Number Bit: No
        .... 0... .... .... = Strict Source Route Bit: No
        .... .000 .... .... = Recursion control: 0
        .... .... 0000 0... = Flags (Reserved): 0
        .... .... .... .000 = Version: GRE (0)
    Protocol Type: MPLS label switched packet (0x8847)
MultiProtocol Label Switching Header, Label: 31, Exp: 0, S: 1, TTL: 64
    0000 0000 0000 0001 1111 .... .... .... = MPLS Label: 31
    .... .... .... .... .... 000. .... .... = MPLS Experimental Bits: 0
    .... .... .... .... .... ...1 .... .... = MPLS Bottom Of Label Stack: 1
    .... .... .... .... .... .... 0100 0000 = MPLS TTL: 64
PW Ethernet Control Word
    Sequence Number: 26329
IEEE 802.3 Ethernet
    Destination: a3:6e:02:af:39:c3 (a3:6e:02:af:39:c3)
        Address: a3:6e:02:af:39:c3 (a3:6e:02:af:39:c3)
        .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
        .... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
    Source: c0:bf:08:00:45:00 (c0:bf:08:00:45:00)
        Address: c0:bf:08:00:45:00 (c0:bf:08:00:45:00)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Length: 84
        [Expert Info (Error/Malformed): Length field value goes past the end of the payload]
            [Message: Length field value goes past the end of the payload]
            [Severity level: Error]
            [Group: Malformed]
Logical-Link Control
    DSAP: NULL LSAP (0x00)
    IG Bit: Individual
    SSAP: NULL LSAP (0x00)
    CR Bit: Command
    Control field: I, N(R)=0, N(S)=32 (0x0040)
        0000 000. .... .... = N(R): 0
        .... .... 0100 000. = N(S): 32
        .... .... .... ...0 = Frame type: Information frame (0x0000)
Data (76 bytes)

0000  40 01 22 a0 0b 01 01 03 0b 01 01 05 08 00 8e 47   @."............G
0010  36 01 03 f1 07 ba 28 0c 00 00 00 00 00 00 00 00   6.....(.........
0020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0040  00 00 00 00 00 00 00 00 00 00 00 00               ............
    Data: 400122a00b0101030b01010508008e47360103f107ba280c...
    [Length: 76]

1 Frame 2: 140 bytes on wire (1120 bits), 140 bytes captured (1120 bits) on interface 0
    Interface id: 0
    Encapsulation type: Ethernet (1)
    Arrival Time: May  9, 2015 01:06:35.491293000 IST
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1431113795.491293000 seconds
    [Time delta from previous captured frame: 0.000254000 seconds]
    [Time delta from previous displayed frame: 0.000254000 seconds]
    [Time since reference or first frame: 0.000254000 seconds]
    Frame Number: 2
    Frame Length: 140 bytes (1120 bits)
    Capture Length: 140 bytes (1120 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ip:gre:mpls:pwethheuristic:pwethcw:eth:llc:data]
Ethernet II, Src: HewlettP_11:cd:40 (65:rt:a9:45:ac:70), Dst: HewlettP_11:ca:d4 (28:be:a9:66:ab:c4)
    Destination: HewlettP_11:ca:d4 (28:be:a9:66:ab:c4)
        Address: HewlettP_11:ca:d4 (28:be:a9:66:ab:c4)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source: HewlettP_11:cd:40 (65:rt:a9:45:ac:70)
        Address: HewlettP_11:cd:40 (65:rt:a9:45:ac:70)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 10.140.218.20 (10.140.218.20), Dst: 10.140.218.19 (10.140.218.19)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
    Total Length: 126
    Identification: 0x2a74 (10868)
    Flags: 0x00
        0... .... = Reserved bit: Not set
        .0.. .... = Don't fragment: Not set
        ..0. .... = More fragments: Not set
    Fragment offset: 0
    Time to live: 64
    Protocol: GRE (47)
    Header checksum: 0x869d [validation disabled]
        [Good: False]
        [Bad: False]
    Source: 10.140.218.20 (10.140.218.20)
    Destination: 10.140.218.19 (10.140.218.19)
    [Source GeoIP: Unknown]
    [Destination GeoIP: Unknown]
Generic Routing Encapsulation (MPLS label switched packet)
    Flags and Version: 0x0000
        0... .... .... .... = Checksum Bit: No
        .0.. .... .... .... = Routing Bit: No
        ..0. .... .... .... = Key Bit: No
        ...0 .... .... .... = Sequence Number Bit: No
        .... 0... .... .... = Strict Source Route Bit: No
        .... .000 .... .... = Recursion control: 0
        .... .... 0000 0... = Flags (Reserved): 0
        .... .... .... .000 = Version: GRE (0)
    Protocol Type: MPLS label switched packet (0x8847)
MultiProtocol Label Switching Header, Label: 30, Exp: 0, S: 1, TTL: 64
    0000 0000 0000 0001 1110 .... .... .... = MPLS Label: 30
    .... .... .... .... .... 000. .... .... = MPLS Experimental Bits: 0
    .... .... .... .... .... ...1 .... .... = MPLS Bottom Of Label Stack: 1
    .... .... .... .... .... .... 0100 0000 = MPLS TTL: 64
PW Ethernet Control Word
    Sequence Number: 14787
IEEE 802.3 Ethernet
    Destination: c5:bf:07:55:99:d9 (c5:bf:07:55:99:d9)
        Address: c5:bf:07:55:99:d9 (c5:bf:07:55:99:d9)
        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)
    Source: 3w:6e:1d:2f:65:00 (3w:6e:1d:2f:65:00)
        Address: 3w:6e:1d:2f:65:00 (3w:6e:1d:2f:65:00)
        .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
        .... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
    Length: 84
        [Expert Info (Error/Malformed): Length field value goes past the end of the payload]
            [Message: Length field value goes past the end of the payload]
            [Severity level: Error]
            [Group: Malformed]
Logical-Link Control
    DSAP: Unknown (0x2a)
    IG Bit: Individual
    SSAP: Unknown (0x74)
    CR Bit: Command
    Control field: I, N(R)=0, N(S)=0 (0x0000)
        0000 000. .... .... = N(R): 0
        .... .... 0000 000. = N(S): 0
        .... .... .... ...0 = Frame type: Information frame (0x0000)
Data (76 bytes)

0000  40 01 38 2c 0b 01 01 05 0b 01 01 03 00 00 96 47   @.8,...........G
0010  36 01 03 f1 07 ba 28 0c 00 00 00 00 00 00 00 00   6.....(.........
0020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................
0040  00 00 00 00 00 00 00 00 00 00 00 00               ............
    Data: 4001382c0b0101050b01010300009647360103f107ba280c...
    [Length: 76]

* Request going from 10.140.218.19 to 10.140.218.20 with label:31
* Reply coming back from 10.140.218.20 to 10.140.218.19 with label:30




No comments:

Post a Comment