3

Very similar to this question, we are considering tapping the FEX uplinks that we have running from Top Of Rack to our Nexus 5k core switches.

Has anyone had success with tapping those uplinks? I have no doubt it is physically possible to tap them with an optical splitter (and feed them into a tap aggregator) but I'm wondering if what's on those ports is plain ethernet, or if there's some encapsulation that needs dealing with.

Is this something anyone can attest to having success with?

Mark Henderson
  • 398
  • 1
  • 12
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Feb 19 '18 at 19:01
  • It was useful but not a complete and correct answer. Sorry I can’t accept it, because I still want to hear from someone who has actually done it. There are products that claim to be able to strip the headers but I never got time to schedule a trial with them, so I would still like to hear from someone who did it. – Mark Henderson Feb 20 '18 at 12:09
  • That's fine. We were just trying to clean things up with a friendly reminder. You would be surprised how many people don't know to do that, or simply forget. – Ron Maupin Feb 20 '18 at 14:19

1 Answers1

3

It's not plain Ethernet. There are a bunch of headers being applied to each frame for VNTag that signify the source HIF port, particular forwarding details, etc. I'd strongly suggest just using SPAN on the parent switch, as the ability of even fairly well-equipped traffic analyzers (i.e. Wireshark) to decode what's happening is pretty limited as the parent <-> FEX communication is definitely Cisco-proprietary.

rnxrx
  • 6,094
  • 1
  • 19
  • 25
  • The issue we have with the 5k is that we are beyond what the core SPANs can provide, hence why we're looking into alternatives. We have 10 FEXs over two cores, and 80Gb running to each FEX. We've got a meeting with vendors soon so I will make sure I bring this up with them to see if their aggregators can deal with/strip those headers. – Mark Henderson Sep 22 '17 at 17:29