To display output on screen (will be in hex) use the following command:. Then transfer the file to whatever system / tool you like to use to read pcaps. p ktcap-uw –uplink vmnic0 –mac 01:00:0c:cc:cc:cc -o /tmp/cdptrace.pcap. To save output to a file (in pcap format):. SSH to the ESXi host (you may need to enable ssh for the host if it isn’t already enabled). This gets a little trickier, as there isn’t an easy way to display the output of a capture at the ESXi CLI (or I just haven’t figured it out – will freely admit that I am a relative beginner in the ways of VMware). It turns out that there is native support in ESXi for viewing Cisco CDP info, as explained in the following VMware KB article: While the method I presented below is valid, it’s a bit low-level. This is a handy tool for those who may not be comfortable with tcpdump or Wireshark, such as field techs who just need to quickly find port info. Start capture on the relevant interface, then enter ‘cdp’ in the filter field Wireshark (running on a Windows system in this example) This can be done in various ways depending on your OS and the capture tool being used – below are a few examples. Knowing this, we just need to run a capture filtering for frames with that destination address. Depending on the options in your capture tool, you may be able to filter by the LLC protocol ID of CDP, which is 0x2000. 
CDP (as well as VTP) messages are sent in frames with an L2 multicast destination address of : 01-00-0c-cc-cc-cc.
We need to deconstruct CDP a bit (there is no magic, right?). For the sake of this post, we’re going to suppose that CDP is enabled on the ports under discussion.) (I realize that many shops prefer to disable CDP on host-facing ports – especially those connected to equipment under the control of another entity. But what if you have to approach the problem from another perspective? Said another way, how would someone at an end-host view the CDP data from an attached Cisco switch? Most network folks are also quite familiar with correlating mac address tables with ARP tables to DNS entries to find out exactly where end hosts are attached. If you’re from the Cisco world, no doubt you make regular use of the ‘sh cdp neighbor’ command to learn about how your network devices are physically connected – especially when learning about a new network with questionable documentation or physical labeling (though that never happens, right?).
0 kommentar(er)
