SE PCAP Types

This section describes the types of SE PCAPs to enable packet capture accordingly.

To start packet capture for an NSX Advanced Load Balancer SE, use the debug serviceengine <SE IP address> command.

The various types of SE PCAPs are tabulated below:

SE PCAPs	Description	Minimum Supported Version
SE level PCAP	Captures every ingress and egress packets received/sent by a given SE. File format: se_core_<core_num>.pcap SE debug flag: debug_pcap_rx, debug_pcap_tx	17.2.12
Dropped PCAP	Packets dropped by SE are captured and stored into pcap file. Reason for drop is stamped on the comment section of the packet. File format: se_dropped_<core_num>.pcapng Note: Few dropped packets might not be present in this capture file but this gives some level of visibility. SE debug flag: debug_pcap_drop	18.2.5
IPC PCAP	IPC messages exchanged between SE’s are captured. Type of IPC message is stamped on comment section of the packet. File format: se_ipc_<core_num>.pcapng SE debug flag: debug_pcap_se_ipc	18.2.5
DOS PCAP	DOS packets are captured. File format: se_dos_<core_num>.pcap SE debug flag: debug_pcap_dos	17.2.12
NAT PCAP	Captures all the NATed traffic on a given SE. Packet comments help in determining if a flow is external/internal. File format: se_nat_<core_num>.pcapng SE debug flag: debug_pcap_nat	21.1.1
ROUTING PCAP	Capture all the packets that are routed by a given SE. File format: se_routing_<core_num>.pcapng SE debug flag: debug_pcap_routing	21.1.1

Note:

Capture knob under debug serviceengine <SE IP address> command will help in enabling all types of captures at once. Since, this starts all the SE captures, disk memory might be consumed.