VSX Tcpdump Problem

[starmen2000]

Hi mates,

When we run tcpdump / cppcap on VSX gateway, we are able to see only ARP request and reply packets. Normally thorugh vsx the whole traffic is going through. in this case when we specify the interface on tcpdump syntax, still we see only arp packets. Anyone has idea?

[PhoneBoy]

What version/JHF?
What precise syntax are you using?
Can you see the traffic with fw monitor or through other means?

[starmen2000]

R81 / Take 68

tcpdump -nni any 

tcpdump -nni bond2.776 and host x.y.z.t

With fw monitor I can not see the traffic if I specify destination IP

[Timothy_Hall · Accepted solution]

This is a quote from my Max Capture: Know Your Packets self-guided video series:

If trying to capture traffic on a Wrp interface in a VSX environment, or on vSEC for NSX-V, fw monitor must be used to
ensure a complete capture. See sk167462: Tcpdump / CPpcap do not show incoming packets on Virtual Switch's Wrp
interface and sk116796: ' tcpdump ' utility does not capture the specified traffic on vSEC for NSX / vSEC Virtual ...
Hypervisor Mode.