For this type of packet capture, SPAN or ELAM is used.

Ethanalyzer provides the users with the following capabilities:Ĭapture packets sent and received by the switch Supervisor CPUĭefine the number of packets to be capturedĭefine the length of the packets to be capturedĭisplay packets with very detailed protocol information or a one-line summaryįilter packets capture on many criteria (capture filter)įilter packets to be displayed on many criteria (display filter)ĭecode the internal header of control packetĪvoid the requirement of using an external sniffing device to capture the trafficĮthanalyzer does not allow hardware-switched traffic to be captured between data ports of the switch. It can capture inband and management traffic on all Nexus platforms. TShark uses the libpcap library, which gives Ethanalyzer the capability to capture and decode packets.

EthanalyzerĮthanalyzer is an NX-OS implementation of TShark, a terminal version of Wireshark. ELAM also is not supported on N5000 or N5500 switches.

Additionally, ELAM is best performed under the supervision of a Cisco Technical Assistance Center (TAC) engineer. The ELAM capture is supported on all Nexus switches, but because it requires deeper understanding of the ASICs and the configuration differs among Nexus platforms, it is outside the scope of this book.

How to use wireshark to get ip inbound