Re: [Ethereal-users] New User - How do I cpature/save Cisco Debugs For Analysis

["M.C. van den Bovenkamp" <marco@xxxxxxxxxxxxxxxxxxx>]

Guy Harris wrote:

> While doing a Google search for "debug ip packet dump" to try to find
> something describing the format of that command's output, I came across:
>
> 	http://www.ethereal.com/lists/ethereal-dev/200010/msg03402.html
>
> which warns about "debug ip packet dump":
>
> 	I would *strongly* recommend against using this command unless
> 	you really know what you're doing and/or don't mind a router
> 	reboot.
>
> 	It is very easy to lose control of the router, because it can
> 	saturate both the serial link and the CPU given sufficient load
> 	on the circuits, and you may need physical access to the router
> 	to recover from this condition.  If you're lucky, the task gets
> 	killed by the executive, if not, the router locks up.
>
> 	I've seen someone do this to a router in South Africa.  He
> 	didn't appreciate my suggestion he should bike over there and
> 	fix it.
>
> 	The SNMP capture has resource usage limitations built in; I'd
> 	suggest using that if this functionality is required.

In this, it's no different from any other 'debug' command; they all come 
with (and rightly so!) dire warnings that go something like 'Here Be 
Tygers. May Cause CPU Meltdown And General Wonkyness. Do Not Try At 
Home.' :-).

You should most certainly use this with *extreme* caution and a Well 
Crafted access list (the command will take one, just like the documented 
'debug ip packet' & 'debug ip packet detailed' will).

But, that said, it has come in handy now and again. It has one caveat 
that I found out later: the resulting dump is only usable if both input 
and output interface of the packet were some form of Ethernet. Because 
it may be called 'debug *ip* packet dump', the resulting hexdump is that 
of a full frame, and only if it has both a normal Ethernet SA & DA, they 
get decoded correctly.

If either of the interfaces is not Ethernet, that's not the case, anf 
Funky Stuff happens when the output of the script gets fed to text2pcap 
:-). But perhaps something could be reverse-enineered about the 
resulting hexdump (fake addresses and using only select bits of it?). I 
haven't looked at it that deeply (yet?).

If by 'SNMP capture' the original writer meant the 'Capture' RMON group, 
only a very select number of Ciscos with a very specific IOS feature set 
have that. This will work (in principle) on all of them; I haven't found 
one yet where 'debug ip packet dump' didn't exist.


--

		Regards,

			Marco.