Eric Stewart: Running Off At The Mouth

As indicated in a previous post, my place of employment uses Cisco equipment, and configures interfaces to span or monitor traffic from other interfaces to one connected to a server (not the interface the server actually uses for network connectivity – just one specifically for the purposes of packet capturing) to aid in troubleshooting of some of the network issues we might run into.

Initially, the port descriptions on the Cisco device are labeled with the monitor server’s name and connected interface.  However, this apparently required too much effort on the part of your typical engineer (just kidding!), so it was requested that I try to come up with some way to label or rename the interface on the server side in order to eliminate the need to look it up.  You wouldn’t think this would be an issue, except that we have at least one monitor server that has monitor interfaces for four different Cisco routers, and it can become a bit confusing when you’re trying to figure out if the backbone router you want to capture traffic from is connected to p1p1, p1p2, p2p1, or p2p2*.

So, here’s what you need to know:

1. Bring the interface down (“ifdown <int>”).
2. Rename the ifcfg-<int> file, e.g.:

   mv /etc/sysconfig/network-scripts/ifcfg-eth3 \
      /etc/sysconfig/network-scripts/ifcfg-router1

3. Edit the file and change the “DEVICE=” line appropriately, using the new name of the interface:

   DEVICE="router1"

4. Use “ifrename” to rename the interface:

   ifrename -i eth3 -n router1

5. Bring the interface back up (“ifup router1”).
6. Double check your /etc/sysctl.conf and change any lines that refer to the old interface name to the new one (and use “sysctl -p” to apply them).

So far, this has stuck through a reboot for me.  A couple of things to keep in mind though:

• Some OS versions may have issues with “-” in the name.  Centos 6.3 didn’t blink, Centos 5.9 did.
• You (obviously) can’t name two interfaces the same thing.

What does this all mean?  Well, say you wanted to do a packet capture from “router1”.  Now, with a renamed interface, you don’t have to guess what interface “router1” is connected to.  You can just:

tshark -i router1 -w dumpfile.cap

Let me know if you have any issues (and if you have solutions as well), as I cobbled this together from several different places and am still not 100% sure how it’s working (in that I’ve read a lot about this and there were many ways to do it, and I’ll admit some nagging doubt about whether or not I’ve hit all the bases here).

*For those who haven’t had the experience yet, newer Centos versions on newer hardware have changed the naming scheme of interfaces.  Instead of starting at “eth0”, ports on the motherboard start at “em1”, and other ports are typically named based on the PCI slot they are in, along with the port designation on the card.  IE, “p1p2” is port 2 on a card using PCI slot 1.