Capture port traffic with tcpdump

Mirror all traffic received on a port to the CPU with dmirror, then capture on the port’s EthernetN interface as usual. Linux also processes the mirrored packets, so this can change the behaviour you are debugging.

The diag shell names ports ce0, xe0 …, SONiC names them Ethernet0, Ethernet4 …, and the numbers do not line up. Look the pair up in knetctrl netif show, which lists each SONiC netdev with its port, for example name=Ethernet0 … port=ce0.

drivshell> dmirror ce0 mode=ingress destport=cpu0
$ sudo tcpdump -ni Ethernet0

Use mode=egress for sent traffic or mode=all for both. Check what is mirrored with dmirror ce0 or dmirror SHow.

Stop mirroring when you are done:

drivshell> dmirror ce0 mode=off

Warning

mode=off removes every mirror on that port, including a SONiC mirror session (config mirror_session) on the same port. SONiC is not told; such a session may have to be removed and added again from SONiC.