Oracle Communications EAGLE (Software)
 

PLA-Support>Sun Systems>CommsGBU>Global Signaling Solutions>SN-SND: Tekelec Eagle 5
 

In this Document

Goal

Solution

Overview

General Usage

Quick Setup

References

Applies to:

Goal

How to use of Eagle Eyes in lieu of requesting Wireshark capture - Rel 46.0 and later.

Solution

Oracle Support Document 2182776.1 (How to Download Eagle Eyes from Oracle SFTP Server (External User)

Oracle Support Document 2182894.1 (How to Download Eagle Eyes from Oracle SFTP Server (Internal User)

Overview

The Eagle Eyes application consists of two components. The first is Eagle Eyes proper, which is located on the Eagle card as part of the GPL running on that card. Eagle Eyes proper (henceforth simply "Eagle Eyes") performs the task of reading Ethernet frames from the card’s Ethernet drivers, packing the frames into GEDTI packets, and sending them to the external application for assembly into a capture file.

The Eagle Eyes PC Application is the part of the system external to the Eagle. The Eagle Eyes PC Application (EEPC) handles the creation of the PCAP file to be delivered to the end user.

General Usage

Eagle Eyes consist of two applications on separate processors working in tandem. One application runs on your PC, and the other runs on the Eagle card. Because the PC initiates the session between itself and the Eagle card application, the OAM EE commands are used to configure the session rather than to create it.

Filtering Mechanism: Because Eagle Eyes does its packet sniffing at the driver level, it sees every single frame that goes into and out of the Eagle card. While it might be handy to have as much information as possible, it would be easy to lose track of important information in a sea of ARP lookups and SCTP heartbeats. Therefore, Eagle Eyes implements a filtering mechanism (ent-ee-flt) that allows users to chose what frames they want included in the capture file. All filtering is performed on the Eagle card; if a frame is filtered out of the trace, it will simply not exist in the capture file output by the ee PC Application.

The filtering mechanism is implemented with a three-tiered system of data structures. At the highest level are filter-sets. A filter-set is a collection of filters, which in turn is a collection of rules.

The use of Eagle Eyes can be used instead of requesting that the customer use Wireshark to capture PDU’s when analyzing a trouble condition on any of the following applications using the following GPL’s - IPSG, IPLHC, IPGHC, ATMHC, SS7HC, SIPHC & DEIRHC.

Quick Setup

This section provides the necessary components, commands and order of execution to run the Eagle Eyes application and perform a trace on the network under surveillance.

1. Necessary components. These components must be present and in service prior to executing the application:
   1. IPSM card (the GEDTI hub) connected to external network.
   2. Host card (the Eagle Eyes card) - this card is connected to the network under surveillance.
   3. PC connected to external network - the IPSM card must be reachable (can ping) from the PC.
2. Command examples to set up the Eagle Eyes application.  (Please refer to the commands manual for details of the command parameters)
   1. Configure Filters:
      
      ent-ee-flt:type=inc:appl=ip:ipprot=tcp:ipsrc=192.168.27.221:ipdst=192.168.22.199
      ent-ee-flt:type=inc:appl=ip:ipprot=udp:ipsrc=192.168.27.221:ipdst=192.168.22.199
      ent-ee-flt:type=inc:appl=ip:ipprot=sctp:stype=data:sctpstr=1
      ent-ee-flt:type=inc:appl=atm:port=a:sscopsu=data:mtp3si=tup
      ent-ee-flt:type=exl:appl=e1t1:port=a2:sutype=msu:mtp3si=snm
      rtrv-ee-flt
      (All fltid’s set up will be displayed)
   2. Configure Host Card: (Please refer to the commands manual for details of the command parameters)
      
      chg-ee-card:loc=<card loc>:fltid=1:action=attach:thr=2000:pktlim=5000 (Host card is the network card under surveillance)
   3. Configure GEDTI Port:
      
      chg-gedti-card:loc=<IPSM card>:port=1025 (port = can be 1025 to 65354)
   4. Activate GEDTI Card:
      
      act-gedti: loc=<IPSM card>
   5. At the user’s PC from a command prompt activate EEPC using the below command example from the PC directory where the eepc.exe file was loaded.
      
      eepc.exe <IPSM IP address> xxxx <location of HOST card> sample.cap (Where xxxx is the configured GEDTI port and sample.cap is the file name)
3. Command examples to deactivate the Eagle Eyes on the STP:

(Where x is the number of the fltid, use the rtrv-ee-flt to find numbers)

Limitations

• Performance and robustness of Eagle Eyes is unspecified. This means that the Eagle Eyes capture on IPSM & network cards will not guarantee (in overload conditions) that all the packets are captured. During overload conditions (too much traffic is exchanged over IMT), the Network card & IPSM cards may boot.

• Execution of an Eagle Eyes trace has an impact on the network card. The impact has not been quantified but it can be assumed that for every packet received on the wire that is captured will count as two TU (one for the original routed packet and one for the copy). Thus, if a trace filter is set to capture all traffic received on a particular interface and the interface is handling 100 TPS, the net impact is 200 TUs.

• IPSM card can process ~15000 packets per second. If packets received from network cards exceed this limit, IPSM card may reboot leading to loss of captured traffic and early termination of connection between EEPC and the network card specified at the time of connection establishment.

• The Eagle OAM IP Security Enhancements feature cannot be turned on while using the Eagle Eyes application. The Eagle Eyes application only works with telnet to connect to the IPSM card.

• User should not use ssh, telnet and such services on IPSM card when EE trace is in progress and vice versa as these services may lead to early connection termination.

• It is not possible to have traces from multiple network cards into the same trace file. This implies one EEPC application can connect to one network card at a time.

References

This solution has no attachment