Accessing the Bridge Monitor Prompt |
To access the Bridge monitor prompt, perform the following steps: |
Step | Action |
1 |
At the Monitor prompt (Monitor>), enter bridge. Example: Monitor> bridge |
2 |
Press Return. The Bridge monitor prompt (BRIDGE>) is displayed. |
Step | Action |
1 |
At the BRIDGE> prompt, enter list bridge. |
2 |
Press Return. The desired information and a new BRIDGE> prompt is displayed. |
Example |
BRIDGE> list bridge |
Bridge state: | Enabled |
Multicast Rate Limiting: | Disabled (400pps) |
No Frame Interval: | 300 seconds |
Raw 802.3 IPX Trans: | Disabled |
Bridge type: | STB |
Ageing time: | 300 seconds |
Number of rehashes: | 0 |
Number of static entries: | 0 |
Number of dynamic entries: | 2308 |
Number of ports | 14 |
Port Interface | Operational State |
MAC Address | Maximum PDU |
Flags |
0 VNbus/0 | Up | 00-00-F8-6F-51-01 | 4491 | MD |
1 Eth/1 | Down | 00-00-F8-6F-51-02 | MD | |
2 Eth/2 | Down | 00-00-F8-6F-51-03 | MD | |
3 Eth/3 | Down | 00-00-F8-6F-51-04 | MD | |
4 Eth/4 | Down | 00-00-F8-6F-51-05 | MD | |
5 Eth/5 | Down | 00-00-F8-6F-51-06 | MD | |
6 Eth/6 | Down | 00-00-F8-6F-51-07 | MD | |
7 Eth/7 | Down | 00-00-F8-6F-51-08 | MD | |
8 Eth/8 | Down | 00-00-F8-6F-51-09 | MD | |
9 Eth/9 | Down | 00-00-F8-6F-51-0A | MD | |
10 Eth/10 | Down | 00-00-F8-6F-51-0B | MD | |
11 Eth/11 | Down | 00-00-F8-6F-51-0C | MD | |
12 Eth/12 | Down | 00-00-F8-6F-51-0D | MD | |
13 Eth/13 | Down | 00-00-F8-6F-51-0E | MD |
Flags: ME = Manual Mode Enabled, MD = Manual Mode Disabled |
Port Activity Counters |
To display information about port activity, perform the following steps: |
Step | Action |
1 |
At the BRIDGE> prompt, enter list counters ports, where ports is the option you must enter to display the desired information. Refer to Table 1 for a list of options and for descriptions of the information that is displayed when you enter the option. |
2 |
Press Return. The desired information and a new BRIDGE> prompt is displayed. |
Command Option |
Description |
all-ports |
Lists port activity counters for all ports. |
port port-number |
Lists port activity counters for a specific port, where port-number is the number of the port for which you want to display information. |
summary |
Displays the sum of activity across all ports for each counter. |
Example |
Port restarts: | 1 |
Total frames received by interfaces: | 748388 |
IP frames fragmented: | 0 |
IP frames not fragmented: | 0 |
Frames submitted to bridging: | 748388 |
Frames submitted to routing: | 154831 |
Frames with unknown dest address: | 0 |
Frames causing learning transactions: | 10078 |
Dropped, source address filtering: | 14 |
Dropped, dest address filtering: | 96473 |
Dropped, protocol filtering: | 0 |
Dropped, address rate limiting: | 0 |
Dropped, protocol rate limiting: | 0 |
Dropped, no buffer available: | 0 |
Dropped, input queue overflow: | 0 |
Dropped, source or dest port blocked: | 0 |
Dropped, terminating queue overflow: | 14 |
Dropped, fragmentation queue overflow: | 0 |
Dropped, translate flood queue overflow: | 0 |
Dropped, translation failure: | 0 |
Frames sent by bridging: | 102077 |
Dropped, transmit queue overflow: | 0 |
Dropped, transmit error: | 0 |
Dropped, too big to send on port: | 0 |
Step | Action |
1 |
At the BRIDGE> prompt, enter list port port-number, where port-number is either the number of the port for which you want to display information or all for information about all ports. |
2 |
Press Return. The desired information and a new BRIDGE> prompt is displayed. |
Examples The first example shows the types of information displayed for any port, other than the VNbus port.The second example shows the types of information displayed for the VNbus port, including state information for each instance of STP running over the VNbus and through the VNbus port. Each instance of STP indicates that one or more VSDs, each of which might be physically located on a different module in the same hub, are linked into a single, larger VSD. The link is established over the VNbus on the MultiSwitch 900. Refer to the Management Guide for additional information about VSDs linked over the VNbus.
|
BRIDGE>list port 13 |
Port Id (dec) | : | 128:13, (hex): 80-0D |
Port State | : | Enabled |
STP Participation | : | Enabled |
Manual Mode | : | Disabled |
Assoc Interface | : | 13 (FDDI/13) |
BRIDGE>list port 0 |
Port Id (dec) | : | 128: 0, (hex): 80-00 |
STP Participation | : | Enabled |
Manual Mode | : | Disabled |
Assoc Interface | : | 0 (VNbus/0) |
Port state per STP instance: |
VSD# | Name | State |
1 | DEFAULT | Forwarding |
2 | TEST | Forwarding |
Step | Action |
1 |
At the BRIDGE> prompt, enter list database selected-information, where selected-information is the option you must enter to display the desired information. Refer to Table 2 for a list of options and for descriptions of the type of information that is displayed when you enter the option. |
2 |
Press Return. The desired information and a new BRIDGE> prompt is displayed. |
Command Option |
Description |
atm |
Lists information for all the LEC learned entries in the database. |
dynamic |
Lists information for all dynamic entries in the database. |
local |
Lists information for all registered entries in the database. |
permanent |
Lists information for all permanent entries in the database. |
port |
Lists information for all addresses associated with the specified port. |
range |
Lists information for all addresses within a specified range. |
static |
Lists information for all static entries in the database. |
all |
Lists information for all addresses associated with all ports. |
Example |
MAC Address Multi Cast* | Rate Limit | Entry Type | Last Seen Port | Learned Port | Allowed Port(s) |
00-00-F8-6F-51-00 | N/A | Registered | All | ||
00-00-F8-6F-51-01 | N/A | Registered | 0 | ||
00-00-F8-6F-51-02 | N/A | Registered | 1 | ||
00-00-F8-6F-51-03 | N/A | Registered | 2 | ||
00-00-F8-6F-51-04 | N/A | Registered | 3 | ||
00-00-F8-6F-51-05 | N/A | Registered | 4 | ||
00-00-F8-6F-51-06 | N/A | Registered | 5 | ||
00-00-F8-6F-51-07 | N/A | Registered | 6 | ||
00-00-F8-6F-51-08 | N/A | Registered | 7 | ||
00-00-F8-6F-51-09 | N/A | Registered | 8 | ||
00-00-F8-6F-51-0A | N/A | Registered | 9 | ||
00-00-F8-6F-51-0B | N/A | Registered | 10 | ||
00-00-F8-6F-51-0C | N/A | Registered | 11 | ||
00-00-F8-6F-51-0D | N/A | Registered | 12 | ||
00-00-F8-6F-51-0E | N/A | Registered | 13 | ||
00-00-F8-6F-51-20 | N/A | Registered | All | ||
00-00-F8-6F-51-22 | N/A | Registered | All | ||
01-80-C2-00-00-00* | Disabled | Registered | All | ||
FF-FF-FF-FF-FF-FF* | Disabled | Registered |
Displaying Protocol Filters To display the protocol filters applied to one or more ports, perform the following steps: |
Step | Action |
1 |
At the BRIDGE> prompt, enter list protocol-filter frame-type, where frame-type is the option you must enter to display the desired information. Refer to Table 3 for a list of options and for descriptions of the information that is displayed when you enter the command. |
2 |
Press Return. The desired information and a new BRIDGE> prompt is displayed. |
Table 3: List Protocol Filter Command Options and Descriptions |
Command Option |
Description |
ethertype protocol hexadecimal value |
Lists the ports on which the specified protocol is filtered, where protocol hexadecimal value is the hexadecimal value of the protocol in which you are interested. Refer to Table 4 for a list of hexadecimal values for common Ethernet-II protocols. Enter 0, the default, to display all Ethernet-II protocols that are filtered. |
dsap protocol hexadecimal value |
Lists the ports on which the specified protocol is filtered, where protocol hexadecimal value is the hexadecimal value of the protocol in which you are interested. Refer to Table 5 for a list of hexadecimal values for common DSAP (also referred to as SAP) protocols. Enter 100, the default, to display all SAP (DSAP) protocols that are filtered. |
snap protocol hexadecimal value |
Lists the ports on which the specified protocol is filtered, where protocol hexadecimal value is the 10-digit hexadecimal value of the protocol in which you are interested. Refer to Table 6 for a list of hexadecimal values for common SNAP protocols. Enter 00-00-00-00-00, the default, to display all SNAP protocols that are filtered. |
all |
Lists all the protocol filters in use, and the ports on which the protocols are filtered. The filters are listed by frame type (Ethernet-II, SNAP, and SNAP) and hexadecimal value. Refer to Table 4, Table 5, and Table 6 for a list of hexadecimal values for common protocols. |
Example |
Destination SAP | Rate Limit | Port(s) |
01 | Disabled | 2-3 |
Ethernet type | Rate Limit | Port(s) |
0800 | Enabled | 4-8 |
No SNAP filters configured |
Table 4: Hexadecimal Values for Common Ethernet-II Protocols |
Protocol |
Hexadecimal Value |
IP |
0800 |
ARP |
0806 |
CHAOS |
0804 |
DECnet MOP Dump/Load |
6000 |
DECnet MOP Remote Console |
6002 |
DECnet |
6003 |
DEC LAT |
6004 |
DEC LAVC |
6007 |
XNS |
0600 |
Maintenance Packet Type |
7030 |
Apollo Domain |
8019 (Ethernet) |
Novell NetWare IPX |
8137 (Ethernet) |
AppleTalk Phase 1 |
809B |
AppleTalk ARP Phase 1 |
80F3 |
Loopback assistance |
9000 |
Protocol |
Hexadecimal Value |
Banyan SAP |
BC (used for only 802.5) |
Novell IPX SAP |
E0 (used for only 802.5) |
NetBIOS SAP |
F0 |
ISO Connectionless Internet |
FE |
Table 6: Hexadecimal Values for Common SNAP OUI/IP Protocols |
Protocol |
Ten-Digit Hexadecimal Value |
AppleTalk Phase 2 |
08-00-07-80-9B |
AppleTalk ARP Phase 2 |
00-00-00-80-F3 |
Proprietary AppleTalk Phase 1 for FDDI |
00-00-93-00-02 |
Proprietary AppleTalk ARP Phase 1 for FDDI |
00-00-93-00-03 |
Displaying Default Protocol Filters You can also display default protocol filters used to filter all frames of a particular type from one or more output bridge ports, using protocols not already filtered as described above. For example, the module can be configured so that Ethernet frames conforming to the AppleTalk Phase 1 protocol are discarded, while a default filter is used to discard all Ethernet frames of any other protocol type such as IP, ARP, DECnet, and so on. To display the default protocol filters applied to one or more ports, perform the following steps: |
Step | Action |
1 |
At the BRIDGE> prompt, enter list default-protocol-filter. |
2 |
Press Return. The desired information and a new BRIDGE> prompt is displayed. |
Example |
Protocol | Allowed Ports |
DSAP | 0-254 |
ETHER | 0-254 |
SNAP | 0-254 |
Step | Action |
1 |
At the BRIDGE> prompt, enter list stp option, where option is the option you must enter to display the desired information. Refer to Table 7 for a list of options and for descriptions of the type of information that is displayed when you enter the option. |
2 |
Press Return. The desired information and a new BRIDGE> prompt is displayed. |
Example |
VSD 3 Math-dept | |
Time since topology change (seconds): | 248262 |
Topology changes: | 0 |
BPDUs received: | 3308 |
BPDUs sent: | 0 |
Port | Interface | BPDUs received | BPDU input overflow | Forward transitions |
0 | VNbus/0 | 3308 | 0 | 1 |
10 | Eth/10 | 0 | 0 | 0 |
Command Option |
Description |
configuration |
Lists the following STP parameters configured on the switch:
|
counters vsd#-or-name |
Lists the following information about STP activity, where vsd#-or-name is the number or name of the VSD for which you want the information displayed. If no number or name is specified, information for all VSDs is displayed.
|
state vsd#-or-name |
Lists the following information about STP activity, where vsd#-or-name is the number or name of the VSD for which you want the information displayed. If no number or name is specified, information for all VSDs is displayed.
|
tree vsd#-or-name |
Lists the following information for each port in the VSD's spanning tree, where vsd#-or-name is the number or name of the VSD for which you want the information displayed. If no number or name is specified, information for all VSDs is displayed.
|
Configuring a MAC Address As a Static Entry |
This section discusses how to add MAC address filters as static entries. This section also describes how to modify and delete static entries. Because static addresses are stored in volatile RAM and are lost when the switch is powered down or restarted, you may find the ability to add static entries to be most useful when trying to isolate network problems. (Refer to Management Guide, Chapter 1, for information about volatile RAM.) Static entries are not affected by address Aging Time. (Refer to Management Guide, Chapter 7, for information about address aging.) The process of filtering network traffic is used to reduce the amount of unnecessary traffic over specific segments of a network, thereby maximizing network capacity and performance. It can also be used to restrict the distribution of sensitive information to specific locations. You can configure the VNswitch module to selectively filter or forward packets it receives, based on their MAC addresses and protocol types. You configure a filter by specifying a set of ports that are allowed for a given MAC address. The address can be an individual, multicast, or broadcast address. If a packet has a source or destination MAC address that is listed in the filter, the packet is allowed on the specified set of ports. If the address is not listed in the filter, the packet is dropped (filtered). |
Source Address Filtering |
A packet received on an input port is dropped (filtered) if the source address is listed in a filter and the input port is not one of the allowed ports. In addition, the source address is not learned. If the input port is one of the allowed ports, the packet is a candidate for forwarding, based on the behavior of destination address filtering and protocol filtering. |
Creating and Modifying a Static MAC Address Filter |
To create or modify a static MAC address filter, perform the following tasks: |
Task |
Description |
1 |
Identify the address to be filtered and the ports on which the address is allowed. |
2 |
Enable or disable multicast rate limiting. |
Identifying the Address and Allowed Ports |
The addresses you specify when creating a filter are added to the switch's static database (volatile RAM). To identify the allowed ports for an address, perform the following steps: |
Step | Action |
1 |
At the BRIDGE> prompt, enter set static-address. You can, alternatively, enter set static-address mac_address, where mac_address is the 12-digit MAC address for which you want to create or modify a filter on the module. If you enter the command using this syntax, and go to step 4. |
2 |
Press Return. The following message is displayed: Address (in 12-digit hex) []? |
3 |
Enter the 12-digit MAC address for which you want to create or modify a static filter. You can enter the address with or without hyphens separating the octets. For example, you can enter 11-22-33-44-55-66 or 112233445566. |
4 |
Press Return. The following message is displayed: Enter allowed ports, ("None", or "All") []? If you are modifying the forwarding ports for an existing address, the previously configured ports are the default. |
5 |
Enter a list of the bridge ports to which you want the packet with the specified MAC address forwarded. (The packet is filtered from those ports not entered.) Enter None if you want the packet filtered from all ports. Enter all if you want the packet allowed on all ports. You can list the forwarding ports individually by separating each with a comma (for example, 0,1,2,3,4,5) or you can enter a range of ports by separating the first and last port numbers in the range with a hyphen (for example, 0-5). You can also combine a list of individual entries with a range of entries (for example, 0-4,6,7). Spaces are not permitted between port numbers and the comma or hyphen. |
6 |
Press Return. If the address is a unicast address, the address is set and the BRIDGE> prompt is displayed. If the address is a multicast address, the following message is displayed: Enable Multicast Rate Limiting (Yes or No)? [No]: Refer to the Enabling and Disabling Multicast Rate Limiting section. If the specified ports do not exist, the address is set for forwarding on the port but the port setting has no effect. A message similar to the following is displayed in addition to the Bridge config or rate limiting prompts, whichever is appropriate: Warning, ports 9, 10 do not exist |
Enabling and Disabling Multicast Rate LimitingMulticast rate limiting is used to minimize the effects of multicast storms. You can restrict multicast storms, consisting of packets that have a specific destination MAC address, to that segment of the network from which the packets are generated. You do so by setting the maximum number of those packets the VNswitch module is to forward per second, and by enabling rate limiting. Rate limiting is enabled on both a per-address basis and a switchwide basis. This section provides instructions about how to enable or disable rate limiting on a per static MAC address basis. Refer to Chapter 7 of the Management Guide for information about setting the maximum number of packets per second and enabling or disabling rate limiting on a switchwide basis. To enable or disable multicast rate limiting for the static address specified in the Identifying the Address and Allowed Ports section, perform the following steps: |
Step | Action |
1 |
Enter Yes to enable Multicast Rate Limiting. Enter No to disable Multicast Rate Limiting. No is the default unless it was previously enabled for the address. |
2 |
Press Return. The selected filter is applied to the module and rate limiting is enabled or disabled, as specified. |
Deleting Static MAC Address Filters |
This section describes how to delete static MAC addresses that you, or another switch administrator, previously entered manually. (Refer to the Creating and Modifying a Static MAC Address Filter section.) Deleting an address filter removes the address from the forwarding database as well as its associated multicast rate limiting status. Note: Permanent, registered, and reserved addresses cannot be deleted. To delete a static MAC address, its filter, and its associated rate limiting records, perform the following steps: |
Step | Action |
1 |
At the BRIDGE> prompt, enter delete mac_address. You can, alternatively, enter delete address, where address is the 12-digit MAC address you want to delete. If you enter the command using this syntax, and go to step 4. |
2 |
Press Return. The following message is displayed: Address (in 12-digit hex) []? |
3 |
Enter the 12-digit MAC address you want to delete. |
4 |
Press Return. The specified address is deleted. If you entered an address that does not exist, the following message is displayed: No entry found for this address. |