[c-nsp] Getting Source MAC of "sh buffers" output

[Phillip Harrison (phiharri)]

Hi Rolf,

Those are pointers to various parts of the actual buffer which you can see with 'dump' or 'packet' keywords. Try adding 'packet' which dumps the buffer from datagramstart where we typically have an Ethernet header, eg. here src mac is 0007.4F1C.E800:

   datagramstart 0x803727A, datagramsize 98, maximum size 260
 0803727A:                            00233369              .#3i
 0803727E: 3A400007 4F1CE800 08004548 0054C36A  :@..O.h...EH.TCj

Cheers,
/Phil

On 30 Jul 2012, at 11:17, Rolf Hanßen wrote:

> Hello,
> 
> I think we got a flooding with ARP packets towards a SUP720-3B, I saw that
> here with "sh buffers input-interface vlan xy header":
> 
> Buffer information for Small buffer at 0x4634BF8C
>  data_area 0x802E5E4, refcount 1, next 0x4639A6A0, flags 0x200
>  linktype 1 (ARP), enctype 1 (ARPA), encsize 14, rxtype 45
>  if_input 0x48C6BA10 (Vlan1050), if_output 0x0 (None)
>  inputtime 19w1d (elapsed 00:09:25.372)
>  outputtime 19w1d (elapsed 00:33:13.308), oqnumber 65535
>  datagramstart 0x802E65A, datagramsize 60, maximum size 308
>  mac_start 0x802E65A, addr_start 0x802E65A, info_start 0x0
>  network_start 0x802E668, transport_start 0x802E67C, caller_pc 0x41DC7428
> 
> 
> Buffer information for Small buffer at 0x4634D4A4
>  data_area 0x802F664, refcount 1, next 0x4639BBB8, flags 0x200
>  linktype 1 (ARP), enctype 1 (ARPA), encsize 14, rxtype 45
>  if_input 0x48C6BA10 (Vlan1050), if_output 0x0 (None)
>  inputtime 19w1d (elapsed 00:09:08.472)
>  outputtime 19w0d (elapsed 1d15h), oqnumber 65535
>  datagramstart 0x802F6DA, datagramsize 60, maximum size 308
>  mac_start 0x802F6DA, addr_start 0x802F6DA, info_start 0x0
>  network_start 0x802F6E8, transport_start 0x802F6FC, caller_pc 0x41DC7428
> 
> Is there a way to find out the MAC-address those packets are coming from ?
> None of the numbers looks like a MAC to me.
> 
> kind regards
> Rolf
> 
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/