Monitoring the Transparent Bridge

Introduction

This document provides information about how to monitor the DIGITAL GS2000 line card transparent bridge and how to configure static addresses. Monitoring includes the ability to display specific information about operational states, activity counters, and various bridge configuration settings. Static addresses you configure are stored in volatile RAM and are lost when the line card is powered down or restarted. The addresses, therefore, must be relearned when power is again applied to the line card.

Accessing and Exiting the Bridge Monitor Prompt

You must access the Bridge monitor prompt to monitor bridge parameters and to configure static MAC addresses. The prompt is accessed from the Monitor prompt (Monitor>).

Accessing the Bridge Monitor Prompt

To access the Bridge monitor prompt, perform the following steps:

Step Action

1

At the Monitor prompt (Monitor>), enter bridge.

Example: Monitor> bridge

2

Press Return. The Bridge monitor prompt (BRIDGE>) is displayed.

Exiting the Bridge Monitor Prompt

You exit the Bridge monitor prompt to return to the Monitor prompt.

Example
To return to the Monitor prompt (Monitor>) from the BRIDGE> prompt, enter exit and then press Return.

Monitoring the Bridge

You can monitor the bridge by displaying such information as operational states, activity counters, and various configuration settings associated with the following bridge software components:

  • General bridging operation

  • Bridge ports

  • MAC address database

  • Protocol filters

  • Spanning Tree Protocol

General Bridging Operation

You can display the following types of information about the bridge:

  • Operational states and port profile

  • Aging parameters

To display a profile of the bridge's ports, aging parameters, and information about the operational state of various bridge functions such as IP fragmentation and rate limiting, perform the following steps:

Step Action

1

At the BRIDGE> prompt, enter list bridge.

2

Press Return. The desired information and a new BRIDGE> prompt is displayed.

Example

BRIDGE> list bridge

Bridge state: Enabled
Multicast Rate Limiting: Disabled (400pps)
No Frame Interval: 300 seconds
Raw 802.3 IPX Trans: Disabled
Bridge type: STB
Ageing time: 300 seconds
Number of rehashes: 0
Number of static entries: 0
Number of dynamic entries: 2308
Number of ports 14
Port Interface Operational
State
MAC Address Maximum
PDU
Flags
0 VLAN/0 Up 00-00-F8-6F-51-01 4491 MD
1  ATM/2 Down 00-00-F8-6F-51-02 MD
2  ATM/3 Down 00-00-F8-6F-51-03 MD
3  ATM/4 Down 00-00-F8-6F-51-04 MD
4  ATM/5 Down 00-00-F8-6F-51-05 MD
5  ATM/6 Down 00-00-F8-6F-51-06 MD
6  ATM/7 Down 00-00-F8-6F-51-07 MD
7  ATM/8 Down 00-00-F8-6F-51-08 MD
8  ATM/9 Down 00-00-F8-6F-51-09 MD
9  ATM/10 Down 00-00-F8-6F-51-0A MD
10  ATM/11 Down 00-00-F8-6F-51-0B MD
11 ATM/12 Down 00-00-F8-6F-51-0C MD
12  ATM/13 Down 00-00-F8-6F-51-0D MD
13  ATM/14 Down 00-00-F8-6F-51-0E MD

Flags:  ME = Manual Mode Enabled, MD = Manual Mode Disabled

Port Activity Counters

To display information about port activity, perform the following steps:

Step Action

1

At the BRIDGE> prompt, enter list counters ports, where ports is the option you must enter to display the desired information. Refer to Table 1 for a list of options and for descriptions of the information that is displayed when you enter the option.

2

Press Return. The desired information and a new BRIDGE> prompt is displayed.

Table 1: List Counters Command Options and Descriptions

Command Option

Description

all-ports

Lists port activity counters for all ports.

port port-number

Lists port activity counters for a specific port, where port-number is the number of the port for which you want to display information.

summary

Displays the sum of activity across all ports for each counter.

Example
BRIDGE>list counters summary

Port restarts: 1
Total frames received by interfaces: 748388
IP frames fragmented: 0
IP frames not fragmented: 0
Frames submitted to bridging: 748388
Frames submitted to routing: 154831
Frames with unknown dest address:  0
Frames causing learning transactions: 10078
Dropped, source address filtering: 14
Dropped, dest address filtering: 96473
Dropped, protocol filtering: 0
Dropped, address rate limiting: 0
Dropped, protocol rate limiting: 0
Dropped, no buffer available: 0
Dropped, input queue overflow: 0
Dropped, source or dest port blocked: 0
Dropped, terminating queue overflow: 14
Dropped, fragmentation queue overflow:  0
Dropped, translate flood queue overflow: 0
Dropped, translation failure: 0
Frames sent by bridging:  102077
Dropped, transmit queue overflow:  0
Dropped, transmit error:  0
Dropped, too big to send on port: 0

Bridge Ports

You can display the following information for one or all bridge ports:

  • Port ID

  • Whether STP and Manual Mode are enabled

  • Name and number of the interface associated with the port

  • State of the port

If the port is a member of multiple VLAN Secure Domains (VSDs), the state of each VSD is listed, followed by the number and name of the VSD.

To display information about one or all bridge ports, perform the following steps:

Step Action

1

At the BRIDGE> prompt, enter list port port-number, where port-number is either the number of the port for which you want to display information or all for information about all ports.

2

Press Return. The desired information and a new BRIDGE> prompt is displayed.

Examples

The following example shows the types of information displayed for any port. Each instance of STP indicates that one or more VSDs are linked into a single, larger VSD. Refer to the DIGITAL GIGAswitch GS2000 Management guide for additional information about VSDs.

 

BRIDGE>list port 1

Port Id (dec) : 128:13, (hex): 80-0D
Port State  : Enabled
STP Participation : Enabled
Manual Mode   : Disabled
Assoc Interface : 1 (FDDI/1)

BRIDGE>list port 2

Port Id (dec) : 128: 0, (hex): 80-00
STP Participation : Enabled
Manual Mode : Disabled
Assoc Interface : 2 (ATM/2)

Port state per STP instance:

VSD# Name State
1   DEFAULT Forwarding
TEST Forwarding

MAC Address Database

You can display the following information for each MAC address in the filtering database:
  • Whether Rate Limiting is enabled for an address

  • Whether the address is a multicast address (an asterisk indicates it is a multicast address)

  • Address entry type (dynamic, reserved, registered, and so on)

  • Last port on which the address was seen (dynamic, unicast static, and unicast permanent addresses only)

  • Port on which the address was learned (dynamic, unicast static, and unicast permanent addresses only)

  • Ports on which the address is allowed (permanent and static addresses only)

You can display this information selectively for addresses of a particular entry type (permanent, static, registered, and so on), for a range of addresses, or on a per-port basis.

To display information about selected portions of the database, perform the following steps:

Step Action

1

At the BRIDGE> prompt, enter list database selected-information, where selected-information is the option you must enter to display the desired information. Refer to Table 2 for a list of options and for descriptions of the type of information that is displayed when you enter the option.

2

Press Return. The desired information and a new BRIDGE> prompt is displayed.

Table 2: List Database Command Options and Descriptions

Command Option

Description

atm

Lists information for all the LEC learned entries in the database.

dynamic

Lists information for all dynamic entries in the database.

local

Lists information for all registered entries in the database.

permanent

Lists information for all permanent entries in the database.

port

Lists information for all addresses associated with the specified port.

range

Lists information for all addresses within a specified range.

static

Lists information for all static entries in the database.

all

Lists information for all addresses associated with all ports.

Example
BRIDGE>list database local

MAC Address Multi Cast* Rate Limit Entry Type  Last Seen Port Learned Port Allowed  Port(s)
00-00-F8-6F-51-00 N/A Registered All
00-00-F8-6F-51-01 N/A Registered 0
00-00-F8-6F-51-02 N/A Registered 1
00-00-F8-6F-51-03 N/A Registered 2
00-00-F8-6F-51-04 N/A Registered 3
00-00-F8-6F-51-05 N/A Registered 4
00-00-F8-6F-51-06 N/A Registered 5
00-00-F8-6F-51-07 N/A Registered 6
00-00-F8-6F-51-08 N/A Registered 7
00-00-F8-6F-51-09 N/A Registered 8
00-00-F8-6F-51-0A N/A Registered 9
00-00-F8-6F-51-0B N/A Registered 10
00-00-F8-6F-51-0C N/A Registered 11
00-00-F8-6F-51-0D N/A Registered 12
00-00-F8-6F-51-0E N/A Registered 13
00-00-F8-6F-51-20 N/A Registered All
00-00-F8-6F-51-22 N/A Registered All
01-80-C2-00-00-00* Disabled Registered All
FF-FF-FF-FF-FF-FF* Disabled Registered

  

Protocol Filters

You can display the types of protocol filters and the default protocol filter applied to one or more ports. Protocol filtering is supported for the following frame types:

  • Ethernet-II

  • Subnetwork Access Protocol (SNAP)

  • Destination Service Access Point (DSAP)

Displaying Protocol Filters

To display the protocol filters applied to one or more ports, perform the following steps:

Step Action

1

At the BRIDGE> prompt, enter list protocol-filter frame-type, where frame-type is the option you must enter to display the desired information. Refer to Table 3 for a list of options and for descriptions of the information that is displayed when you enter the command.

2

Press Return. The desired information and a new BRIDGE> prompt is displayed.

Table 3: List Protocol Filter Command Options and Descriptions

Command Option

Description

ethertype protocol hexadecimal value

Lists the ports on which the specified protocol is filtered, where protocol hexadecimal value is the hexadecimal value of the protocol in which you are interested. Refer to Table 4 for a list of hexadecimal values for common Ethernet-II protocols. Enter 0, the default, to display all Ethernet-II protocols that are filtered.

dsap protocol hexadecimal value

Lists the ports on which the specified protocol is filtered, where protocol hexadecimal value is the hexadecimal value of the protocol in which you are interested. Refer to Table 5 for a list of hexadecimal values for common DSAP (also referred to as SAP) protocols. Enter 100, the default, to display all SAP (DSAP) protocols that are filtered.

snap protocol hexadecimal value

Lists the ports on which the specified protocol is filtered, where protocol hexadecimal value is the 10-digit hexadecimal value of the protocol in which you are interested. Refer to Table 6 for a list of hexadecimal values for common SNAP protocols. Enter 00-00-00-00-00, the default, to display all SNAP protocols that are filtered.

all

Lists all the protocol filters in use, and the ports on which the protocols are filtered. The filters are listed by frame type (Ethernet-II, SNAP, and SNAP) and hexadecimal value. Refer to Table 4, Table 5, and Table 6 for a list of hexadecimal values for common protocols.

Example
BRIDGE>list protocol-filter all

Destination SAP Rate Limit Port(s)
01 Disabled 2-3
Ethernet type Rate Limit Port(s)
0800 Enabled 4-8
No SNAP filters configured

Table 4: Hexadecimal Values for Common Ethernet-II Protocols

Protocol

Hexadecimal Value

IP

0800

ARP

0806

CHAOS

0804

DECnet MOP Dump/Load

6000

DECnet MOP Remote Console

6002

DECnet

6003

DEC LAT

6004

DEC LAVC

6007

XNS

0600

Maintenance Packet Type

7030

Apollo Domain

8019 (Ethernet)

Novell NetWare IPX

8137 (Ethernet)

AppleTalk Phase 1

809B

AppleTalk ARP Phase 1

80F3

Loopback assistance

9000

Table 5: Hexadecimal Values for Common DSAP Protocols

Protocol

Hexadecimal Value

Banyan SAP

BC (used for only 802.5)

Novell IPX SAP

E0 (used for only 802.5)

NetBIOS SAP

F0

ISO Connectionless Internet

FE

Table 6: Hexadecimal Values for Common SNAP OUI/IP Protocols

Protocol

Ten-Digit Hexadecimal Value

AppleTalk Phase 2

08-00-07-80-9B

AppleTalk ARP Phase 2

00-00-00-80-F3

Proprietary AppleTalk Phase 1 for FDDI

00-00-93-00-02

Proprietary AppleTalk ARP Phase 1 for FDDI

00-00-93-00-03

Displaying Default Protocol Filters

You can also display default protocol filters used to filter all frames of a particular type from one or more output bridge ports, using protocols not already filtered as described above. For example, the line card can be configured so that Ethernet frames conforming to the AppleTalk Phase 1 protocol are discarded, while a default filter is used to discard all Ethernet frames of any other protocol type such as IP, ARP, DECnet, and so on.

To display the default protocol filters applied to one or more ports, perform the following steps:

Step Action

1

At the BRIDGE> prompt, enter list default-protocol-filter.

2

Press Return. The desired information and a new BRIDGE> prompt is displayed.

Example
BRIDGE>list default protocol-filter

Protocol Allowed Ports
DSAP 0-254
ETHER 0-254
SNAP 0-254

Spanning Tree Protocol

You can display the following information about STP:

  • Configuration parameters such as the Bridge Hello Time, port Priorities and Costs, the number of VSDs on a port, and whether STP is enabled on a port

  • Activity data such as the number of times the network topology has changed and the number of BPDUs sent and received

  • Whether STP is active on a given port

  • Information about the designated root and designated bridge for each port

To display information about the Spanning Tree Protocol, perform the following steps:

Step Action

1

At the BRIDGE> prompt, enter list stp option, where option is the option you must enter to display the desired information. Refer to Table 7 for a list of options and for descriptions of the type of information that is displayed when you enter the option.

2

Press Return. The desired information and a new BRIDGE> prompt is displayed.

Example
BRIDGE>list stp counters 1

VSD 3 Math-dept
Time since topology change (seconds): 248262
Topology changes: 0
BPDUs received:  3308
BPDUs sent: 0
Port Interface BPDUs received BPDU input overflow Forward transitions
0 VLAN/0 3308 0 1
10 ATM/10 0 0 0

Table 7: List STP Command Options and Descriptions

Command Option

Description

configuration

Lists the following STP parameters configured on the line card:

  • Bridge Maximum Age

  • Bridge Hello Time

  • Bridge Forward Delay

  • Hold Time (This value is fixed at one second and is not configurable, as required by IEEE standard 802.1D.)

  • Interface type and number, Priority, Cost, Administrative State, and number of VSDs on each port

counters vsd#-or-name

Lists the following information about STP activity, where vsd#-or-name is the number or name of the VSD for which you want the information displayed. If no number or name is specified, information for all VSDs is displayed.

  • Time, in seconds, since the current topology change within the VSD was detected. This value is zero when there is no topology change in effect.

  • Number of changes in network topology within the VSD since the VSD was created.

  • Number of BPDUs received and sent by the VSD.

  • Number of BPDUs received, BPDU input overflow, and forward transitions for each port in the VSD.

state vsd#-or-name

Lists the following information about STP activity, where vsd#-or-name is the number or name of the VSD for which you want the information displayed. If no number or name is specified, information for all VSDs is displayed.

  • ID (a combination of the bridge priority and address) for the instance of STP in the VSD

  • ID (a combination of the bridge priority and address) of the root bridge in the VSD's spanning tree

  • Path Cost of the root port in the VSD's spanning tree

  • Which port is the root port on the VSD's spanning tree

  • Current Bridge Max Age, Hello Time, and Forward delay dictated by the root bridge and used by all bridges in the VSD's spanning tree

  • Whether the VSD's spanning tree has detected (True or False) a topology change

  • Whether the root bridge has confirmed (True or False) a topology change in the VSD's spanning tree

  • State (Forwarding, Blocking, Listening, Learning, or Down) of each port in the VSD

tree vsd#-or-name

Lists the following information for each port in the VSD's spanning tree, where vsd#-or-name is the number or name of the VSD for which you want the information displayed. If no number or name is specified, information for all VSDs is displayed.

  • Associated interface number

  • Designated root

  • Designated cost

  • Designated bridge

  • Designated port

Configuring a MAC Address As a Static Entry

This section discusses how to add MAC address filters as static entries. This section also describes how to modify and delete static entries. Because static addresses are stored in volatile RAM and are lost when the line card is powered down or restarted, you may find the ability to add static entries to be most useful when trying to isolate network problems. (Refer to Management Guide, Chapter 1, for information about volatile RAM.) Static entries are not affected by address Aging Time. (Refer to Management Guide, Chapter 7, for information about address aging.)

The process of filtering network traffic is used to reduce the amount of unnecessary traffic over specific segments of a network, thereby maximizing network capacity and performance. It can also be used to restrict the distribution of sensitive information to specific locations. You can configure the GS2000 line card to selectively filter or forward packets it receives, based on their MAC addresses and protocol types.

You configure a filter by specifying a set of ports that are allowed for a given MAC address. The address can be an individual, multicast, or broadcast address. If a packet has a source or destination MAC address that is listed in the filter, the packet is allowed on the specified set of ports. If the address is not listed in the filter, the packet is dropped (filtered).

Source Address Filtering

A packet received on an input port is dropped (filtered) if the source address is listed in a filter and the input port is not one of the allowed ports. In addition, the source address is not learned.

If the input port is one of the allowed ports, the packet is a candidate for forwarding, based on the behavior of destination address filtering and protocol filtering.

Destination Address Filtering

A packet about to be placed on an output port is forwarded if the destination address is listed in a filter and the output port is one of the allowed ports. If the address was not previously learned, the packet is flooded to the subset of the allowed ports that are in the forwarding state.

Creating and Modifying a Static MAC Address Filter

To create or modify a static MAC address filter, perform the following tasks:

Task

Description

1

Identify the address to be filtered and the ports on which the address is allowed.

2

Enable or disable multicast rate limiting.

Identifying the Address and Allowed Ports

The addresses you specify when creating a filter are added to the line card's static database (volatile RAM). To identify the allowed ports for an address, perform the following steps:

Step Action

1

At the BRIDGE> prompt, enter set static-address.

You can, alternatively, enter set static-address mac_address, where mac_address is the 12-digit MAC address for which you want to create or modify a filter on the line card. If you enter the command using this syntax, and go to step 4.

2

Press Return. The following message is displayed:

Address (in 12-digit hex) []?

3

Enter the 12-digit MAC address for which you want to create or modify a static filter. You can enter the address with or without hyphens separating the octets. For example, you can enter 11-22-33-44-55-66 or 112233445566.

4

Press Return. The following message is displayed:

Enter allowed ports, ("None", or "All") []?

If you are modifying the forwarding ports for an existing address, the previously configured ports are the default.

5

Enter a list of the bridge ports to which you want the packet with the specified MAC address forwarded. (The packet is filtered from those ports not entered.) Enter None if you want the packet filtered from all ports. Enter all if you want the packet allowed on all ports. You can list the forwarding ports individually by separating each with a comma (for example, 0,1,2,3,4,5) or you can enter a range of ports by separating the first and last port numbers in the range with a hyphen (for example, 0-5). You can also combine a list of individual entries with a range of entries (for example, 0-4,6,7). Spaces are not permitted between port numbers and the comma or hyphen.

6

Press Return.

If the address is a unicast address, the address is set and the BRIDGE> prompt is displayed.

If the address is a multicast address, the following message is displayed:

Enable Multicast Rate Limiting (Yes or No)? [No]:

Refer to the Enabling and Disabling Multicast Rate Limiting section.

If the specified ports do not exist, the address is set for forwarding on the port but the port setting has no effect. A message similar to the following is displayed in addition to the Bridge config or rate limiting prompts, whichever is appropriate:

Warning, ports 9, 10 do not exist

Enabling and Disabling Multicast Rate Limiting

Multicast rate limiting is used to minimize the effects of multicast storms. You can restrict multicast storms, consisting of packets that have a specific destination MAC address, to that segment of the network from which the packets are generated. You do so by setting the maximum number of those packets the GS2000 line card is to forward per second, and by enabling rate limiting.

Rate limiting is enabled on both a per-address basis and a line card-wide basis. This section provides instructions about how to enable or disable rate limiting on a per static MAC address basis. Refer to Chapter 7 of the Management Guide for information about setting the maximum number of packets per second and enabling or disabling rate limiting on a line card-wide basis.

To enable or disable multicast rate limiting for the static address specified in the Identifying the Address and Allowed Ports section, perform the following steps:

Step Action

1

Enter Yes to enable Multicast Rate Limiting.

Enter No to disable Multicast Rate Limiting. No is the default unless it was previously enabled for the address.

2

Press Return. The selected filter is applied to the line card and rate limiting is enabled or disabled, as specified.

Deleting Static MAC Address Filters

This section describes how to delete static MAC addresses that you, or another administrator, previously entered manually. (Refer to the Creating and Modifying a Static MAC Address Filter section.) Deleting an address filter removes the address from the forwarding database as well as its associated multicast rate limiting status.

Note:  Permanent, registered, and reserved addresses cannot be deleted.

To delete a static MAC address, its filter, and its associated rate limiting records, perform the following steps:

Step Action

1

At the BRIDGE> prompt, enter delete mac_address.

You can, alternatively, enter delete address, where address is the 12-digit MAC address you want to delete. If you enter the command using this syntax, and go to step 4.

2

Press Return. The following message is displayed:

Address (in 12-digit hex) []?

3

Enter the 12-digit MAC address you want to delete.

4

Press Return. The specified address is deleted. If you entered an address that does not exist, the following message is displayed:

No entry found for this address.