Focus

Prisma SD-WAN ION CLI Reference

tcpdump

Table of Contents

tcpdump

Use the tcpdump command to capture the TCP, or IP packets received or transferred over a network on a specific interface and used for network debugging and traffic analysis. The packet data is printed on a console or saved to a future analysis file or transfer. The following (args) options are automatically included in the device:

"-A", "b", "-e", "-K", "-#", "-p", "-q", "-S", "-t", "-tt", "-ttt", "-tttt", "-ttttt", "-u", "-v", "-vv", "-vvv", "-x", "-xx", "-X", "-XX" "-B", "-c", "-E", "-j", "-M", "-Q", "-T", "-s" "-C"

Capturing packets using the tcpdump command is currently not supported on sub-interfaces or SVIs for ION device software versions 6.1.x, 6.2.x, and 6.3.x. However, traffic flow of interest on such interfaces can be captured on parent interface, with the help of available (args) options.

For capturing the packets:
tcpdump interface args=” “ show
For saving packets capture to a file:
tcpdump interface args=” “ show | save filename
For viewing and exporting a .pcap file:
file view sample.pcap

Command

tcpdump (interface name or number <args= " " | show | save file=filename>)

Options

interface	Enter the interface to listen on.
show	Displays TCP packet information.
save file	Enter the name of the file in which the tcpdump is saved.

Command Notes

Role	Super, Read Only
Related Commands	—
Introduced in	Release 4.4.1

Example

tcpdump filtering on host IP 8.8.8.8, protocol = icmp, and display
				ethernetframe info (-e)
				tcpdump controller1 args=" -e host 8.8.8.8 and icmp" show tcpdump:verbose 
				output suppressed, use -v or -vv for full protocol decode
				listening on eth0, link-type EN10MB (Ethernet), capture size 65535
				bytes 14:06:13.488774 00:50:56:92:30:be > 00:50:56:92:8b:1a,
				ethertype IPv4 (0x0800), length 98: 192.168.30.10 > 8.8.8.8: ICMP
				echo request, id 12410, seq 0, length 64
				14:06:13.5395143e:2d:5f:3a:be:bd > 00:50:56:92:30:be,
				ethertype IPv4 (0x0800),length

tcpdump controller1 args="-vvv" show
				tcpdump: listening on eth0, link-type EN10MB (Ethernet), 
				capture size 262144 bytes
				06:04:09.589948 ARP, Ethernet (len 6), IPv4 (len 4), 
				Request who-has 179.19.44.2 (ff:ff:ff:ff:ff:ff) tell 179.19.44.7, length 46
				06:04:09.589953 ARP, Ethernet (len 6), IPv4 (len 4),
				Request who-has 179.19.44.2 (ff:ff:ff:ff:ff:ff) tell 179.19.44.7, length 78

tcpdump controller1 args="-c 5" save file=tcpdump_capture.pcap
				Saving...
				Press CTR+C to stop.
				tcpdump: listening on eth0, link-type EN10MB (Ethernet), 
				capture size 262144 bytes
				5 packets captured

ssh interface

tcpping