Cml Packet Capture

Workflow: Capture and Analyze (Full Pipeline)

When a user says "capture traffic between R1 and R2 and analyze it":

1. Find the link: Use get_links (from cml-topology-builder) to find the link ID between R1 and R2
2. Start capture: start_capture with optional filter (e.g., "icmp", "tcp port 179")
3. Generate traffic: Tell the user to generate traffic (or use execute_command to ping)
4. Stop capture: stop_capture after sufficient traffic is collected
5. Download pcap: download_capture to save the pcap file locally
6. Analyze with Packet Buddy: Hand off to the packet-analysis skill:
   • pcap_summary — overview
   • pcap_protocol_hierarchy — protocol breakdown
   • pcap_conversations — who talked to whom
   • pcap_expert_info — errors, retransmissions
   • pcap_filter — drill into specific traffic
7. Report findings: Summarize the analysis in plain English

Workflow: Targeted Protocol Capture

When troubleshooting a specific protocol:

BGP Troubleshooting

1. start_capture with pcap_filter="tcp port 179"
2. Wait for BGP events (or trigger with clear ip bgp)
3. stop_capture
4. download_capture
5. Analyze: Look for OPEN, KEEPALIVE, UPDATE, NOTIFICATION messages
6. Check for: hold timer expiry, capability mismatch, prefix limit exceeded

OSPF Troubleshooting

1. start_capture with pcap_filter="ospf"
2. Wait for OSPF events (or trigger with clear ip ospf process)
3. stop_capture
4. download_capture
5. Analyze: Look for Hello, DBD, LSR, LSU, LSAck packets
6. Check for: area mismatch, auth failure, MTU mismatch, dead timer expiry

ICMP / Connectivity

1. start_capture (no filter, or pcap_filter="icmp")
2. execute_command on source node: "ping {destination}"
3. stop_capture
4. download_capture
5. Analyze: Look for echo request/reply, unreachable, TTL exceeded
6. Check for: asymmetric routing, ACL drops, MTU issues

Spanning Tree

1. start_capture with pcap_filter="stp"
2. Wait for STP convergence or trigger topology change
3. stop_capture
4. download_capture
5. Analyze: BPDUs, topology change notifications, root bridge elections

Capture Filters

CML uses BPF (Berkeley Packet Filter) syntax for capture filters:

Workflow: Compare Before/After

When verifying a configuration change:

1. Capture before: Start capture, collect baseline traffic
2. Stop and download: Save as before.pcap
3. Make the change: Apply configuration via cml-node-operations
4. Capture after: Start new capture, collect post-change traffic
5. Stop and download: Save as after.pcap
6. Compare: Analyze both pcaps with Packet Buddy
7. Report: Document the differences (e.g., "BGP converged in 3s after route-map change")

Integration with Packet Buddy

After downloading a pcap from CML, use these Packet Buddy tools for analysis:

Important Rules

• Lab must be running — captures only work on links in a started lab
• One capture per link — stop an existing capture before starting a new one
• Use filters for busy links — unfiltered captures on high-traffic links can be large
• Set max_packets — prevent runaway captures; 10000 packets is usually enough
• Download before stopping — some CML versions clear the capture buffer on link state change
• File naming: Save pcaps with descriptive names like r1-r2-bgp-capture.pcap
• Record in GAIT — log captures and findings for audit trail