I am trying to capture CDP packets from our Cisco switches to gather documentation. I have tried using tcpdump using command we use on Oracle Linux or Solaris, but neither work. VSI support wasn't any help - and wasn't sure tcpdump could find a CDP packet.

Linux
tcpdump -qv -s 1500 -c 1 'ether[20:2] == 0x2000'

Solaris
tcpdump -nv -s 1500 -c 1 ether dst 01:00:0c:cc:cc:cc

tcpdump -v -s 1500 -c 1000 -b 4000 ether[20:2] = 0x2000
tcpdump: Filtering in user process
tcpdump: listening on IE1, link-type EN10MB (Ethernet), capture size 1500 bytes
Cancel

0 packets captured
0 packets received by filter
0 packets dropped by kernel

Has anybody done this before or have any hints?

Shael Richmond
International Paper

tcpdump -nve -c1000 ether host 01:00:0c:cc:cc:cc

> tcpdump: listening on IE1, [...]

Is that interface on the same LAN segment as the CDP packets?

I know nothing, but:

https://learningnetwork.cisco.com/s/article/cisco-discovery-protocol-cdp-x

o CDP only works on directly connected interfaces.

o CDP runs over the data link layer only. Therefore, two systems
that support different network-layer protocols can learn about
each other.

On Tuesday, October 24, 2023 at 6:26:04 PM UTC-5, Steven Schweda wrote:
> > tcpdump: listening on IE1, [...]
>
> Is that interface on the same LAN segment as the CDP packets?
>
>
Well there is no interface switch for tcpdump like there is on Linux.
eia0 is unused
eib0 is primary to the switch
eic0 is backup to the switch

Shael

> Well there is no interface switch for tcpdump like there is on Linux.

Does that answer the question?

So your VMS "tcpdump" is SYS$SYSTEM:TCPIP$TCPDUMP.EXE?

> eib0 is primary to the switch

I'd expect that to be IE1 (with EIA0 = IE0, EIC0 = IE2, and so on),
so it might not matter.

One problem with open-source-based programs supplied by the OS vendor
is that you don't always get the source, which can make troubleshooting
hard(er).

On 2023-10-24 22:39:00 +0000, Shael Richmond said:

> I am trying to capture CDP packets from our Cisco switches to gather
> documentation. I have tried using tcpdump using command we use on
> Oracle Linux or Solaris, but neither work. VSI support wasn't any
> help - and wasn't sure tcpdump could find a CDP packet.
>
> Linux
> tcpdump -qv -s 1500 -c 1 'ether[20:2] == 0x2000'
> ...
> Has anybody done this before or have any hints?

Given the likely platform differences in the network stacks, I suspect
you already have your answer; this is below IP.

For this case, I'd expect to either set that MAC address on the NIC, or
set the NIC into promiscuous mode, and then wait for traffic via $qio
or $io_perform to the NIC.

There are some old open-source "lavc" monitoring tools for cluster
traffic from antiquity, and similarly-antediluvian stuff that looks for
the equally ancient MOP SYSID messages, and build off or pattern off
that example code.

Though you could check whether tcpdump port to OpenVMS can even set MAC
addresses or promiscuous mode, and work from there.

Easiest would be to capture this traffic using a platform with a
tcpdump port that supports this, of course.

That could be OpenVMS, but whether whatever driver layer or tun/tap
layer this tcpdump port is tied into doesn't seem to offer what you
want.

Might swing back and look at this later, but for the current scheduling.

--
Pure Personal Opinion | HoffmanLabs LLC

On Wednesday, October 25, 2023 at 9:12:18 AM UTC-5, Stephen Hoffman wrote:
> On 2023-10-24 22:39:00 +0000, Shael Richmond said:
>

> Given the likely platform differences in the network stacks, I suspect
> you already have your answer; this is below IP.
>
> For this case, I'd expect to either set that MAC address on the NIC, or
> set the NIC into promiscuous mode, and then wait for traffic via $qio
> or $io_perform to the NIC.
>
> There are some old open-source "lavc" monitoring tools for cluster
> traffic from antiquity, and similarly-antediluvian stuff that looks for
> the equally ancient MOP SYSID messages, and build off or pattern off
> that example code.
>
> Though you could check whether tcpdump port to OpenVMS can even set MAC
> addresses or promiscuous mode, and work from there.
>
> Easiest would be to capture this traffic using a platform with a
> tcpdump port that supports this, of course.
>
> That could be OpenVMS, but whether whatever driver layer or tun/tap
> layer this tcpdump port is tied into doesn't seem to offer what you
> want.
>
Yeah I think I am out of luck. I used ifconfig to turn on promiscuous mode but that didn't help either. Then I found -
1.2.5.4. Restrictions
The following restrictions apply to using tcpdump on OpenVMS:
Copy-all mode is on by default on OpenVMS.
Promiscuous mode is not available, so tracing must be issued on either the source or destination host.
Only Ethernet native tracing on is supported on OpenVMS.

Shael Richmond