No traffic is being captured in MTP
Article ID: 36227
Updated On:
Products
Issue/Introduction
Introduction/Summary:
No traffic is being captured by the MTP.
Background:
This article describes the steps to troubleshooting the capture daemon (nqcapd).
Environment:
CA Multi-Port Monitor (any version)
Instructions:
• On the System Status page, check the physical port(s) that are associated with the logical port. Are the ports connected? (Note: a physical port disconnecting will trigger an SNMP trap so it is useful to check the nqsnmptrap*.logs).
20090414-14:01:15 mtpCaptureTrap - WARNING: Port 0 physical connection is down
20090414-14:01:15 Trap sent to host <hostname>
• Do the Capture Card Physical Port statistics indicated any data is being received? Note that the physical port statistics show traffic coming in on the interface. These statistics represent traffic before any filtering and deduplication is performed. The receive rate is the current rate; the packet and byte counts are cumulative since the last time the nqcapd process was started. To reset the packet and byte counts to zero, you need to restart the nqcapd process.
• On the System Status page, does the logical port status show Running. If it shows Error, hover over the icon to display the reason for the error. If the error indicates a problem setting a Hardware Filter see article TEC1226973.
• Is the nqcapd process running? Are the other processes running?
• On the Administration->Maintenance->System Logs, look at the most recent nqsnmptrap log. Are there any mtpCaptureTrap messages indicating that a logical port could not be started? If so, look at the nqnapacapd log for more information. The following is a sample from the nqsnmptrap log indicating an error on a hardware filter:
20090402-12:12:31 mtpCaptureTrap - ERROR: Hardware filter for logical port 2 contains an error.
20090402-12:12:31 Trap sent to host <machinehost>
• In the nqnapacapd log, find the messages when the nqcapd process last started (look for the log message “nqnapacapd starting”). Included in the start-up messages, you will see messages related to starting each logical port. Below is an example from a 2x10GB configuration where 2 logical ports are being used.
20090409-13:13:57 [Message] Creating Packet Feed(0).
20090409-13:13:57 [Message] Creating memory cache for feed(0) of size: 62914560
…
20090409-13:13:57 [Message] Creating Packet Feed(1).
20090409-13:13:57 [Message] Creating memory cache for feed(1) of size: 629145600
20090409-13:13:57 Command: Deduplication[DynOffset=Layer2HeaderSize; Offset=12] = (Channel==0)
20090409-13:13:57 Command: Capture[Feed=0;SliceOffset=1;SliceAddHeader=Layer2And3And4HeaderSize]=((mIPv4Protocol==6) AND Channel==0)
The Capture[Feed=n] command sets up the filter information. Make sure there is no error following this command that indicates a parsing error (syntax incorrect) or “filter too big” error. For more information on Hardware Filters, see article TEC1226973.
20090409-13:13:57 Command: Deduplication[DynOffset=Layer2HeaderSize; Offset=12] = (Channel==1)
20090409-13:13:57 Command: Capture[Feed=1;SliceOffset=1;SliceAddHeader=Layer2And3And4HeaderSize]=((mIPv4Protocol==6) AND Channel==1)
20090409-13:13:57 [Message] Starting 2 feeds.
Look for any error messages indicating CC_NO_MORE error returned by the driver. For more information on this error, see article TEC1293396.
20090409-13:13:57 [Message] Feed(0) thread created.
20090409-13:13:57 [Message] Feed(1) thread created.
20090409-13:13:57 [Message] Controller running.
Additional Information:
Environment
Component:
Feedback
