ACI ELAM Packet Capture – CLI Example Guide

ASIC Types

Rough guide to asic deployments for ACI switches (Updated)
Northstar: ns: – Gen1
Alpine: alp – Spines
Rocky: roc – F/FX/FXP
Tahoe: tah – GC/E/EX

(vsh_lc) show platform internal hal l2 port gpdq
Use Interface 'Ss' for specifying interface src-id
Trigger Init command select options

Input Select Lines Supported
3 Outerl2-outerl3-outerl4
4 Innerl2-innerl3-inner l4
5 Outerl2-innerl2
6 Outerl3-innerl3
7 Outerl4-innerl4

Output Select Lines Supported
0  Pktrw
1 Always used on ACI
5  Sideband
debug platform internal [ns|alp|roc|tah] elam asic 0

trigger reset
trigger init in-select {in-select-code} out-select 1

set [outer|inner] [arp|ipv4|ipv6|l2|l4] [options]
set [outer|inner] l2 [src_mac|dst_mac|...|]
set [outer|inner] [ipv4] [src_ip|dst_ip|dscp|...|]
set srcid {interface-src-id}

start 
status
report 
report | grep ip.da | grep ip.sa | ... 

Helper command to decode hex in CLI
dec 0x00

Depending on where the capture is required the in-select code and setting the ‘set’ command outer|inner will be different. This is due to the composition of the frame/packet on switch ingress or egress and fabric side interface or host side interface.

The ELAM capture will only capture the first frame/packet and terminate capture when triggered. The status output will show ‘ARMED’ when active and will show ‘TRIGGERED’ when a frame/packet has matched.

Example,

If we are looking for a ingress packet coming from a host port using L3 header filters, this will be a native frame without encapsulation (i.e. fabric VXLAN), so we would want to look at the outer header in the ‘set’ command and use in-select code of ‘6’ which provides the outer and inner L3 headers to capture on. Of course there is no L3 inner as this is a native frame from a host, so we use the ‘set outer’ command for the filter.

If we are looking to capture a packet on ingress into the switch from the fabric based on a endpoint MAC & IPv4 filter, the frame will have an outer VXLAN frame used in the fabric overlay and an inner packet which is the original native frame between endpoints. So we need to set the in-select code to ‘4’ and use the ‘set inner’ ‘l2’ & ‘ipv4’ filters to match what we are looking for.

You can probably see there are different ways of achieving the same thing by changing the in-select code and then using the relevant set outer|inner option, just keep in mind what the frame looks like from an layered encapsulation perspective and which layer you want to filter on, then select the relevant in-select code and filter inner|outer option.

References (Updated):

https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2016/pdf/BRKACI-2102.pdf

https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2020/pdf/BRKDCN-3020.pdf

https://www.cisco.com/c/en/us/support/docs/switches/nexus-9000-series-switches/213848-nexus-9000-cloud-scale-asic-tahoe-nx-o.html