TCPDUMP Packet Captures

The TCPDUMP feature is a new feature on BOLT that allows users to mirror and capture packets that are passing through the OLT.  In the past, TAC has had the capability to do this, but it was never a customer feature on the CLI.  The BOLT CLI allows users to capture packets and have them saved to a file on the OLT.  Users can then use the sftp interface of the OLT to get the capture files off of the OLT.  

Supported Interfaces

The TCPDUMP facility allows performing a tcpdump on the following interfaces: 

• Uplink LAGs: net1 through net12 can be used as a source for the tcpdump.
• 10G Uplinks: sfp1-1-1 through sfp1-1-4 can be used to dump from individual 10g interfaces.
• 40/100G Uplinks: qsfp1-2-1 through qsfp1-2-6 allow dumping from the uplink 40G and 100G interfaces.
• PON ports: MDS1-1-1 through MDS1-1-16 allow dumping from any of the PON ports.

Video

Access OLT Command Line Interface (CLI)

Connect via Console Serial RJ45

The BOLT is equipped with a Console Serial RJ45 interface which provides direct access to the Command Line Interface (CLI) found on all Tellabs OLTs. To use this interface, attach a standard Cisco serial cable from the OLT Console port to any serial port or USB to serial cable.

Once the cable is connected, open a serial terminal program (TeraTerm, putty, HyperTerminal, etc.) Typically, a serial port for the connection is automatically created. Select the correct port and login to the BOLT CLI interface to begin the turnup process.

When connecting directly to the OLT using the serial port, the serial parameters should be configured for standard N-8-1 (115, 200 bit/s, N, 8, 1) settings as follows: 

• Speed: 115200
• Parity: none
• Data bits: 8
• Stop bits: 1

1. Log into the OLT CLI. The default username and password for the system are: admin/tellabs

   Tellabs Linux BOLT 3.1.33 MDS1-ESUA ttyS0 MDS1-ESUA login: admin <enter> Password: tellabs <enter> Welcome, admin! Last login: Mon Sep 15 18:22:55 EDT 2025 from 10.99.99.110 on pts/1 admin connected from 127.0.0.1 using console on MDS1-ESUA

TCPDUMP CLI Interface

1. On your local PC, verify or set up a sftp capture folder. 
      C:/usr/bob/sftp/capture/
2. From the MDS1-ESUA# command line, input tolt system diagnostics start ?,  and press Enter. 
3. The possible completions are displayed, followed by the descriptions of the attributes. 

MDS1-ESUA# config <enter>
MDS1-ESUA<config># tolt system diagnostics start ? <enter>
Possible completions:
  dir         Traffic direction to capture.
  filename    Name of the pcap file to save in /usr/bob/sftp/capture/
  interface   <list of supported interfaces>
  options     Additional tcpdump command-line options, sanitized.
  vlan        VLAN ID or 'any' for untagged/mixed traffic.
MDS1-ESUA#_

The following attributes can be configured at capture start: 

• dir: Direction can be ingress, egress, or both
• filename: The filename to save the capture to.  File is saved to /usr/bob/sftp/capture.
• interface: The name of the interface to capture from, supported interfaces are: 
  • MDS1-1-<pon>: Where pon is the pon number from 1..16.
  • NET<num>: Where num is the net interface number from 1..12.
  • QSFP1-2-<num>: Where num is the QSFP port number from 1..6.
  • SFP1-1-<num>: Where num is the SFP number from 1..4.
• options: These are options to pass to tcpdump to affect the capture.  
  • port x: Where x is the port number to snoop packets to
  • host <ip>: To filter to just a specific IP address.
  • ether host <mac>: To filter to just a specific mac.
  • src/dst: can be used with the above commands to further filter specific source ports/dest ports or IPs.
  • -c <count>: To stop capturing after a certain number of packets.  
• vlan: The vlan ID to snoop, or any to snoop all vlans.

TCPDUMP Example

In the following example, we will filter the packet capture with the following attributes.

• dir: both
• filename: test1.pcap
• interface: NET1
• options: "-c 20 port 123"

• vlan: any

1. From the MDS1-ESUA# command line, input tolt diagnostics capture start dir both filename test1.pcap interface NET1 options "-c port 123" vlan any and press Enter. 
2. Outputs similar to the following are displayed:

MDS1-ESUA# tolt diagnostics capture start dir both filename test1.pcap interface NET1 
options "-c port 123" vlan any <enter>
action-success true
MDS1-ESUA#_

3. The capture has started. We will now force some packets to happen by toggling ntp off and then on.
4. To enter the config mode, go to the MDS1-ESUA# command line, input config and press Enter.
5. To enter the ntp config mode, go to the MDS1-ESUA<config># command line, input tolt system ntp config ntp-peer-list 1 ?, and press Enter.
6. The possible ntp completions are displayed.

MDS1-ESUA# config <enter>
entering configuration mode terminal
MDS1-ESUA<config># tolt system ntp config ntp-peer-list 1 ? <enter>
Possible completions:
  admin-state
  encription-type
  key-id
  key phrase   the key to be sued to access encrypted servers
  <cr>
MDS1-ESUA<config>#

7. To generate some ntp packets, go to the MDS1-ESUA<config># command line, input tolt system ntp config ntp-peer-list 1 admin-state disabled, and press Enter. 
8. Go to the MDS1-ESUA<config-ntp-peer-list-1># command line, input commit, and press Enter. 
9. Go to the MDS1-ESUA<config-ntp-peer-list-1># command line, input tolt system ntp config ntp-peer-list 1 admin-state enabled, and press Enter.
10. Go to the MDS1-ESUA<config-ntp-peer-list-1># command line, input commit, and press Enter. 
11. Go to the MDS1-ESUA<config-ntp-peer-list-1># command line, input exit, and press Enter. 
12. Go to the MDS1-ESUA<config># command line, input exit, and press Enter. Output similar to the following is displayed.

MDS1-ESUA<config># tolt system ntp config ntp-peer-list 1 admin-state disabled <enter>
MDS1-ESUA<config-ntp-peer-list-1># commit <enter>
commit complete.
MDS1-ESUA<config-ntp-peer-list-1># tolt system ntp config ntp-peer-list 1 admin-state enabled <enter>
MDS1-ESUA<config-ntp-peer-list-1># commit <enter>
commit complete.
MDS1-ESUA<config-ntp-peer-list-1># exit <enter>
MDS1-ESUA<config># exit <enter>
MDS1-ESUA#

13. To stop the capture, go to the MDS1-ESUA# command line, input tolt diagnostics capture stop, and press Enter. Output similar to the following is displayed.

MDS1-ESUA# tolt diagnostics capture stop <enter>
action success false
MDS1-ESUA#

14. The success of the capture stop command is false because we stopped at 20 packets.
15. Then retrieve the file by using sftp browser (i.e. WinSCP) do a refresh and pull the file from the path: /usr/bob/sftp/capture and deposit in the download folder.
    
     
16. Go to the local downloads, refresh the folder and double click on test1.pcap to open the file.
    
     
17. Wireshark can then be utilized to view the pcap file or, in the case of an issue, it can be forwarded to TAC.