topic VSX Tcpdump Problem in Firewall and Security Management

VSX Tcpdump Problem

starmen2000 — Thu, 17 Aug 2023 15:01:30 GMT

Hi mates,

When we run tcpdump / cppcap on VSX gateway, we are able to see only ARP request and reply packets. Normally thorugh vsx the whole traffic is going through. in this case when we specify the interface on tcpdump syntax, still we see only arp packets. Anyone has idea?

Re: VSX Tcpdump Problem

PhoneBoy — Thu, 17 Aug 2023 15:10:28 GMT

What version/JHF?
What precise syntax are you using?
Can you see the traffic with fw monitor or through other means?

Re: VSX Tcpdump Problem

starmen2000 — Thu, 17 Aug 2023 15:14:01 GMT

R81 / Take 68

tcpdump -nni any

tcpdump -nni bond2.776 and host x.y.z.t

With fw monitor I can not see the traffic if I specify destination IP

Re: VSX Tcpdump Problem

Timothy_Hall — Thu, 17 Aug 2023 16:53:10 GMT

This is a quote from my Max Capture: Know Your Packets self-guided video series:

If trying to capture traffic on a Wrp interface in a VSX environment, or on vSEC for NSX-V, fw monitor must be used to
ensure a complete capture. See sk167462: Tcpdump / CPpcap do not show incoming packets on Virtual Switch's Wrp
interface and sk116796: ' tcpdump ' utility does not capture the specified traffic on vSEC for NSX / vSEC Virtual Edition
Hypervisor Mode.