WEBVTT 1 00:00.000 --> 00:05.000 So before we jump right into configuring IPSLA, 2 00:05.000 --> 00:09.280 a very important aspect that we may wanna be able to do 3 00:09.280 --> 00:13.160 in our lab environments is to do packet captures. 4 00:13.160 --> 00:17.000 This way we can see things like BFD in operation, 5 00:17.000 --> 00:19.440 we can watch OSPF neighborhoods, 6 00:19.440 --> 00:22.320 we can see that IPSLA is doing what we want it to, 7 00:22.320 --> 00:23.760 and so on. 8 00:23.760 --> 00:26.240 So since this is one of our first labs 9 00:26.240 --> 00:29.000 where we're actually gonna be configuring some technologies 10 00:29.000 --> 00:30.560 and we can get down to the wire WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 10 00:29.000 --> 00:30.560 and we can get down to the wire 11 00:30.560 --> 00:32.720 and actually see how they function, 12 00:32.720 --> 00:35.920 let's take just a moment to see how to do these packet 13 00:35.920 --> 00:39.280 captures in various different environments. 14 00:39.280 --> 00:41.560 We're gonna be looking at two specifically. 15 00:41.560 --> 00:44.160 We're going to look at EVENG, 16 00:44.160 --> 00:46.600 specifically EVENG Pro, 17 00:46.600 --> 00:49.360 which does have wire shark built in. 18 00:49.360 --> 00:51.360 There are ways to do packet captures 19 00:51.360 --> 00:54.360 on EVENG Community Edition as well. 20 00:54.360 --> 00:56.480 We're not gonna be covering that here. 21 00:56.480 --> 01:00.240 We're also going to look at, of course, Cisco's CML WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 21 00:56.480 --> 01:00.240 We're also going to look at, of course, Cisco's CML 22 01:00.240 --> 01:02.080 or Cisco modeling labs, 23 01:02.080 --> 01:04.560 and down below, we're gonna tell you 24 01:04.560 --> 01:08.880 how to actually do a packet capture on the devices themselves. 25 01:08.880 --> 01:10.520 Now the reason that one's important 26 01:10.520 --> 01:13.520 is if you don't have one of these environments 27 01:13.520 --> 01:15.840 that actually supports packet capture, 28 01:15.840 --> 01:18.720 you can always do it right on the device. 29 01:18.720 --> 01:20.640 But in this case, let's go ahead and take a look 30 01:20.640 --> 01:22.400 at those two environments. 31 01:22.400 --> 01:25.440 Also be aware that if you're using another choice, 32 01:25.440 --> 01:28.000 such as possibly GNS3, 33 01:28.000 --> 01:30.400 they have packet capture built in as well. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 33 01:28.000 --> 01:30.400 they have packet capture built in as well. 34 01:30.400 --> 01:33.440 I just don't happen to have that particular environment 35 01:33.440 --> 01:34.800 that I can show you. 36 01:34.800 --> 01:38.240 But I do have EVENG and CML2. 37 01:38.240 --> 01:39.800 So let's jump in and take a look 38 01:39.800 --> 01:42.160 at how to do those packet captures. 39 01:42.160 --> 01:43.440 As we're doing this, 40 01:43.440 --> 01:46.480 I would also encourage you to have a packet decoder. 41 01:46.480 --> 01:48.480 I'm gonna be using wire shark 42 01:48.480 --> 01:50.840 so that when we get these PCAP files, 43 01:50.840 --> 01:53.240 we actually have something to open them on, 44 01:53.240 --> 01:54.720 on our workstation. 45 01:54.720 --> 01:56.200 So all of that said, 46 01:56.200 --> 01:58.040 let's jump in and take a look. 47 01:58.040 --> 02:00.960 We'll go ahead and start with EVENG. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 47 01:58.040 --> 02:00.960 We'll go ahead and start with EVENG. 48 02:00.960 --> 02:04.840 So here I'm starting with a topology 49 02:04.840 --> 02:08.080 that I just happened to have saved for some other things. 50 02:08.080 --> 02:12.280 Let's take a look at how we would capture here on, say, 51 02:12.280 --> 02:16.600 for example, gigabit one on router one. 52 02:16.600 --> 02:21.600 All we have to do here in EVENG is right click on the node. 53 02:21.600 --> 02:23.800 We go to capture 54 02:23.800 --> 02:27.040 and then choose the interface that we wanna capture on. 55 02:27.040 --> 02:29.480 So for example, gigabit one. 56 02:29.480 --> 02:32.160 This will actually launch this built-in instance WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 56 02:29.480 --> 02:32.160 This will actually launch this built-in instance 57 02:32.160 --> 02:35.320 of wire shark, which is running in a container 58 02:35.320 --> 02:37.800 on the EVENG server. 59 02:37.800 --> 02:39.120 In this particular case, 60 02:39.120 --> 02:41.800 we are capturing on an ethernet link. 61 02:41.800 --> 02:45.920 So we wanna make sure we choose that layer two encapsulation. 62 02:45.920 --> 02:48.120 Let's go ahead and hit okay. 63 02:48.120 --> 02:50.600 And this will launch wire shark. 64 02:50.600 --> 02:54.080 As you can see here, it's already capturing traffic. 65 02:54.080 --> 02:57.360 And of course, you can resize this window. 66 02:57.360 --> 02:59.200 And if you want, you can actually use 67 02:59.200 --> 03:00.960 the magnifying glasses here to make WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 67 02:59.200 --> 03:00.960 the magnifying glasses here to make 68 03:00.960 --> 03:03.240 the fields a little larger. 69 03:03.240 --> 03:04.080 But you can see here 70 03:04.080 --> 03:07.040 that this is actually doing a live real-time capture 71 03:07.040 --> 03:08.480 off the network. 72 03:08.480 --> 03:09.880 Anytime you want, 73 03:09.880 --> 03:11.720 anytime you've already seen the traffic 74 03:11.720 --> 03:13.320 that you wanna capture, 75 03:13.320 --> 03:16.880 you can of course come right over here and click on stop. 76 03:16.880 --> 03:18.640 Once you've stopped this, 77 03:18.640 --> 03:22.680 you can of course use wire shark here to examine the packets. 78 03:22.680 --> 03:24.120 So for example, 79 03:24.120 --> 03:27.240 we could click on this OSPF packet right here, 80 03:27.240 --> 03:28.480 down at the bottom, 81 03:28.480 --> 03:31.440 we can see that it's open shortest path first, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 81 03:28.480 --> 03:31.440 we can see that it's open shortest path first, 82 03:31.440 --> 03:33.760 we can open up the OSPF header, 83 03:33.760 --> 03:35.240 we can see right here 84 03:35.240 --> 03:38.760 that the message type, for example, is a hello packet. 85 03:38.760 --> 03:41.800 We see the source OSPF router ID, 86 03:41.800 --> 03:44.960 we see that it's for the backbone area, area zero, 87 03:44.960 --> 03:46.760 and so on. 88 03:46.760 --> 03:49.880 If you want, you can also go up here to file, 89 03:49.880 --> 03:51.920 choose save as, 90 03:51.920 --> 03:55.520 navigate into this then client drives folder, 91 03:55.520 --> 03:58.400 into the GUA/CFS folder, 92 03:58.400 --> 04:00.000 into download, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 93 04:00.000 --> 04:01.640 and then give it a file name. 94 04:01.640 --> 04:05.440 Hit save. 95 04:05.440 --> 04:08.160 And we're gonna get an error here from wire shark, 96 04:08.160 --> 04:11.320 but notice in the top right of my screen, 97 04:11.320 --> 04:15.520 it actually downloaded the file here in Firefox. 98 04:15.520 --> 04:18.480 So if I were to close this window, 99 04:18.480 --> 04:21.040 then here, look in my downloads folder, 100 04:21.040 --> 04:23.680 we can see that it has in fact downloaded 101 04:23.680 --> 04:26.840 this capture.pcapNG. 102 04:26.840 --> 04:29.160 If we double click on this, 103 04:29.160 --> 04:32.840 this will now open in wire shark here on my desktop, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 103 04:29.160 --> 04:32.840 this will now open in wire shark here on my desktop, 104 04:32.840 --> 04:33.680 and of course, 105 04:33.680 --> 04:35.480 I can now navigate through this 106 04:35.480 --> 04:38.800 and do all the normal things that I would do in wire shark, 107 04:38.800 --> 04:41.840 as far as applying filters and all that sort of thing, 108 04:41.840 --> 04:44.080 I can do that right here. 109 04:44.080 --> 04:47.600 So that's how you do a packet capture on eVangi, 110 04:47.600 --> 04:49.680 and download the file. 111 04:49.680 --> 04:53.680 Now let's take a look at Cisco CML2. 112 04:53.680 --> 04:56.360 So here we are in CML, 113 04:56.360 --> 04:59.200 and here the process is a little bit different 114 04:59.200 --> 05:01.440 because we capture on links, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 114 04:59.200 --> 05:01.440 because we capture on links, 115 05:01.440 --> 05:04.520 rather than devices and their interfaces. 116 05:04.520 --> 05:09.520 So for example, we can highlight Gigabit2 here on router one, 117 05:09.520 --> 05:11.520 it'll bring up all the statistics 118 05:11.520 --> 05:13.160 and everything for it on the right, 119 05:13.160 --> 05:15.320 we can actually see our packets and bytes 120 05:15.320 --> 05:17.960 through this interface increasing, 121 05:17.960 --> 05:21.040 because remember, we do actually have BFD running 122 05:21.040 --> 05:23.000 on this interface right now, 123 05:23.000 --> 05:27.280 but we can now right click on it and go to packet capture. 124 05:27.280 --> 05:29.400 This will bring up our packet capture window 125 05:29.400 --> 05:31.160 down here at the bottom. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 125 05:29.400 --> 05:31.160 down here at the bottom. 126 05:31.160 --> 05:33.360 We can rearrange some things here quickly 127 05:33.360 --> 05:35.320 to make this a little bit easier to see. 128 05:35.320 --> 05:40.040 We'll move our diagram up a bit here, 129 05:40.040 --> 05:42.840 and we'll resize the window at the bottom, 130 05:42.840 --> 05:44.080 what you'll probably wanna do, 131 05:44.080 --> 05:47.640 now you could of course just hit start right now, 132 05:47.640 --> 05:49.840 it's already capturing for the interface, 133 05:49.840 --> 05:51.560 which we can see right here, 134 05:51.560 --> 05:53.440 but you might wanna go into settings 135 05:53.440 --> 05:55.960 and take a look at some of the defaults. 136 05:55.960 --> 05:59.320 Under settings, the first thing we see is it defaults 137 05:59.320 --> 06:02.840 to a maximum of only 50 packets. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 137 05:59.320 --> 06:02.840 to a maximum of only 50 packets. 138 06:02.840 --> 06:05.760 So we might wanna change that for this demonstration, 139 06:05.760 --> 06:09.000 let's go ahead and capture like 200 packets. 140 06:09.000 --> 06:12.640 You can also of course specify the max time 141 06:12.640 --> 06:14.680 that the capture will run for. 142 06:14.680 --> 06:18.160 So maybe it'll take you two hours to get to 200 packets 143 06:18.160 --> 06:20.360 and you only want it to run for 20 minutes. 144 06:20.360 --> 06:22.360 You can specify that here. 145 06:22.360 --> 06:26.400 You can also specify BPF templates 146 06:26.400 --> 06:28.800 as far as what you wanna capture, 147 06:28.800 --> 06:33.800 or you can manually put in a BPF filter here on the right. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 147 06:28.800 --> 06:33.800 or you can manually put in a BPF filter here on the right. 148 06:33.800 --> 06:36.200 If you put your mouse over the eye, 149 06:36.200 --> 06:38.480 it'll actually tell you that it's looking 150 06:38.480 --> 06:40.800 for Berkeley packet filters here 151 06:40.800 --> 06:43.160 to filter the types of packets captured. 152 06:43.160 --> 06:45.840 So again, you can either choose one of the templates 153 06:45.840 --> 06:50.000 or you can just manually type in a filter here. 154 06:50.000 --> 06:51.360 Either way, once you've done that, 155 06:51.360 --> 06:53.360 you'll wanna come up here to apply. 156 06:53.360 --> 06:55.800 And then once you have everything set the way you want, 157 06:55.800 --> 06:57.960 come over here and click start. 158 06:57.960 --> 07:03.600 We can see here it's already gone to capture not running, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 158 06:57.960 --> 07:03.600 We can see here it's already gone to capture not running, 159 07:03.600 --> 07:07.080 which means it's already captured 200 packets. 160 07:07.080 --> 07:10.040 Now of course, we can scroll down here through the bottom. 161 07:10.040 --> 07:13.040 We can see the different packets that it's captured. 162 07:13.040 --> 07:15.520 Notice down here, they're sorted by pages. 163 07:15.520 --> 07:18.040 So we could go to example to page four, 164 07:18.040 --> 07:21.920 or we could actually click on this dropdown here 165 07:21.920 --> 07:25.480 and choose how many lines to display on the output. 166 07:25.480 --> 07:27.120 If you choose the negative one, 167 07:27.120 --> 07:29.960 there's no limit that will show all of them. 168 07:29.960 --> 07:32.520 In our case, we only captured 200. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 168 07:29.960 --> 07:32.520 In our case, we only captured 200. 169 07:32.520 --> 07:35.880 So choosing 250 would of course show them all. 170 07:35.880 --> 07:37.040 Now if we look down over here, 171 07:37.040 --> 07:39.160 we can see different types of packets, 172 07:39.160 --> 07:41.600 but this isn't quite as easy to read 173 07:41.600 --> 07:44.760 as it would be, say for example, in wire shark. 174 07:44.760 --> 07:49.120 So once again, we probably want to be able to download this. 175 07:49.120 --> 07:52.000 So again, this one's a little more straightforward. 176 07:52.000 --> 07:55.520 We simply come up here and choose download. 177 07:55.520 --> 07:57.960 And we can see here it will immediately go 178 07:57.960 --> 08:01.680 to downloading that file as a .pcap. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 178 07:57.960 --> 08:01.680 to downloading that file as a .pcap. 179 08:01.680 --> 08:05.320 So now all we have to do is go back to our downloads folder. 180 08:06.640 --> 08:09.320 Once again, double click the file, 181 08:09.320 --> 08:11.680 and it opens it here in wire shark. 182 08:11.680 --> 08:15.360 We can of course, as before, look down through all of these. 183 08:15.360 --> 08:19.040 We certainly see that BFD is running. 184 08:19.040 --> 08:20.600 Notice if we open any one of these, 185 08:20.600 --> 08:22.320 we can see the BFD message, 186 08:22.320 --> 08:25.520 and we see that this is simply a BFD echo. 187 08:25.520 --> 08:27.880 So we're going to have quite a few of those. 188 08:27.880 --> 08:31.720 If however, we were to scroll down a little bit here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 188 08:27.880 --> 08:31.720 If however, we were to scroll down a little bit here. 189 08:31.720 --> 08:34.640 Here we see those BFD control messages. 190 08:34.640 --> 08:38.280 This is what's actually keeping the BFD neighborhood up. 191 08:38.280 --> 08:39.720 Remember in the previous video, 192 08:39.720 --> 08:42.560 we discussed how there's two different intervals, 193 08:42.560 --> 08:46.120 one for the control message and one for the echoes. 194 08:46.120 --> 08:48.240 You can see here that the echoes 195 08:48.240 --> 08:50.760 are going every 50 milliseconds. 196 08:50.760 --> 08:54.280 However, the BFD control messages, in this case, 197 08:54.280 --> 08:56.200 the one I have highlighted is going from router one 198 08:56.200 --> 08:57.400 to router three. 199 08:57.400 --> 09:00.000 Of course, right below this is router three WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 200 09:00.000 --> 09:01.760 going back to router one. 201 09:01.760 --> 09:04.200 But we can see in the control messages here, 202 09:04.200 --> 09:06.120 if we open this up, 203 09:06.120 --> 09:10.000 we can see that this has a lot more information in it, 204 09:10.000 --> 09:12.440 including where it's actually requesting 205 09:12.440 --> 09:15.920 those desired intervals being every one second 206 09:15.920 --> 09:19.480 for the control messages and every 50 milliseconds 207 09:19.480 --> 09:21.280 for the echo interval. 208 09:21.280 --> 09:24.440 So this is why packet capturing is so important. 209 09:24.440 --> 09:27.960 We can actually come in here and see the details 210 09:27.960 --> 09:30.360 of the BFD that we just set up. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 210 09:27.960 --> 09:30.360 of the BFD that we just set up. 211 09:30.360 --> 09:34.000 And we're going to want to see this with our IPSLA as well, 212 09:34.000 --> 09:37.200 which is why I wanted to take a moment to take a look at this. 213 09:37.200 --> 09:42.560 So in this video, we saw how to do a packet capture, 214 09:42.560 --> 09:47.560 both on E-Vengie and on Cisco's CML2. 215 09:47.560 --> 09:50.240 We also saw how to download those 216 09:50.240 --> 09:52.600 so we can look at them in a local packet decoder, 217 09:52.600 --> 09:54.920 which is usually a little bit better. 218 09:54.920 --> 09:57.160 In this case, we used Wireshark, 219 09:57.160 --> 10:00.280 which is probably the most popular one out there, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 219 09:57.160 --> 10:00.280 which is probably the most popular one out there, 220 10:00.280 --> 10:03.480 although there are, of course, other choices. 221 10:03.480 --> 10:05.640 I did mention during the introduction 222 10:05.640 --> 10:08.960 that you can also capture on the device itself. 223 10:08.960 --> 10:11.200 We're not going to demonstrate that here, 224 10:11.200 --> 10:13.440 but the instructions on how to do that 225 10:13.440 --> 10:15.400 are below this video. 226 10:15.400 --> 10:18.600 So this is actually gonna wrap up part one 227 10:18.600 --> 10:20.800 of this two-part skill. 228 10:20.800 --> 10:24.360 So in part two, join me as we jump in 229 10:24.360 --> 10:27.840 and actually start configuring IPSLA. 230 10:27.840 --> 10:30.040 And of course, we'll be taking a look at it here WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000 230 10:27.840 --> 10:30.040 And of course, we'll be taking a look at it here 231 10:30.040 --> 10:31.840 in Wireshark as well. 232 10:31.840 --> 10:32.840 I'll see you there.