Configure What Just Happened (WJH) Using CLI

By Default, NVIDIA®WHAT JUST HAPPENED® is enabled. If it is disabled, use the following command to enable it:

switch (config) # what-just-happened <all | acl | forwarding | layer-1 | buffer> enable

In Spectrum systems, in order to enable buffer drop monitoring, one interface must be enabled as a recirculation port. For more information see Ethernet Interface Commands section.

To disable WJH via CLI use the “no” form of the command:

switch (config) # no what-just-happened <all | acl | forwarding | layer-1 | buffer> enable

To display the WJH buffer of dropped packets use the "show what-just-happened" with/without options (detailed in the commands section).

Dropped packet events' display may have a delay of to up to 30 seconds due to a predefined hardware polling interval.

To manually clear WJH buffer use the following command:

switch (config) # clear what-just-happened <all | acl | forwarding | layer-1 | buffer>

To display the WJH aggregation record, use the "show what-just-happened aggregated" with options (detailed in the commands section).

Note that due to hardware polling timing issues, it may be possible to observe dropped packet events that occurred shortly before the clear command was executed.

To automatically generate a WJH PCAP file as a result of discards, the following configuration is required. The value of <sec> determines how often the system checks whether a pcap should be generated. For example, if you enter a value of 300, up to 5 minutes may elapse between the discarding of packets and the creation of the pcap file.

switch (config) # what-just-happened auto-export all enable 
switch (config) # logging events what-just-happened-packets enable
switch (config) # logging events what-just-happened-packets interval <sec>

To see what pcap files have been generated, issue the following command:

switch (config) # show files tcpdump 
wjh_auto_export_all_2020_05_18_09_36_12.pcap

WJH Wireshark dissector enables Wireshark users to analyze WJH pcap files. It displays the packets' added metadata. You may log into the WebUI and click the "Download Wireshark Plugin" button in the Status → What Just Happened page in order to download the Wireshark plugin file. After downloading the file, place it in the Wireshark application in Windows under %APPDATA%\Wireshark\plugins.

Wireshark dissector was tested on version 2.6.3.

WJH Commands

what-just-happened

	what-just-happened <all \| acl \| forwarding \| layer-1 \| buffer> [all-severities \| notice \| warning \| error] enable no what-just-happened <all \| acl \| forwarding \| layer-1 \| buffer> [all-severities \| notice \| warning \| error] enable Enables showing dropped packet information. The no form of the command disables showing dropped packet information.
Syntax Description	all	Drop group containing all packets dropped
	acl	Access-list drops
	forwarding	Drop group containing L2, L3, port and tunnel related drops
	layer-1	Drop group containing layer-1 event
	buffer	Buffer overflow drops
	all-severities	Configure drop with any severity Default: all-severities enabled
	notice	Configure drop with notice severity
	warning	Configure drop with warning severity
	error	Configure drop with error severity
Default	Enabled
Configuration Mode	config
History	3.7.1000
	3.7.1100	Updated Example and Default
	3.8.1000	Updated Syntax and Example
	3.8.2000	Added ACL option
	3.9.0300	Added layer-1 option
	3.9.0500	Added buffer drop option
	3.9.1000	Updated note
	3.9.2000	Updated example and notes, adding support for WJH event suppression by the severity for each drop group.
Example	switch (config) # what-just-happened forwarding notice enable
Related Commands	show what-just-happened status interface ethernet recirculation
Notes	In Spectrum systems, in order to enable buffer drop monitoring, one interface must be enabled as a recirculation port. In Spectrum-2 systems, it is sufficient to configure what-just-happened buffer enable. In both cases, the enabling configuration reduces by 1 the number of monitor sessions that can be configured. It will fail if the maximum number of monitor sessions are already configured. Layer-1 drop group do not support severities Disabling and enabling the WJH or any drop group will not affect the severity configuration

what-just-happened auto-export

	what-just-happened auto-export <all \| acl \| forwarding \| buffer> enable no what-just-happened auto-export <all \| acl \| forwarding \| buffer> enable Enables auto-generated pcap files. The no form of the command disables the auto-generation of pcap files.
Syntax Description	all	Drop group containing all packets dropped
	acl	Access-list drops
	forwarding	Drop group containing L2, L3, port and tunnel related drops
	buffer	Buffer overflow drops
Default	Enabled
Configuration Mode	configure terminal
History	3.8.1000
	3.8.2000	Added ACL option
	3.9.0500	Added buffer drop option
Example	switch (config) # what-just-happened auto-export forwarding enable
Related Commands	what-just-happened enable
Notes	If auto-export is disabled for acl, forwarding or buffer, dropped packets in those groups do not count towards the threshold for generating a pcap, as defined in the 'logging events what-just-happened-packets' commands.

clear what-just-happened

	clear what-just-happened <all \| acl \| forwarding \| layer-1 \| buffer> Flushes data from cache DB.
Syntax Description	all	Drop group containing all packets dropped
	acl	Access-list drops
	forwarding	Drop group containing L2, L3, port and tunnel related drops
	layer-1	Drop group containing layer-1 event
	buffer	Buffer overflow drops
Default	N/A
Configuration Mode	config
History	3.7.1000
	3.8.1000	Updated Syntax and Example
	3.8.2000	Added ACL option
	3.9.0300	Added layer-1 option
	3.9.0500	Added buffer drop option
Example	switch (config) # clear what-just-happened forwarding
Related Commands
Notes	Clear WJH intends to clear all the events already seen by the user, but will not clear events in the hardware that were not yet read by WJH-lib. As such, it is possible that WJH events observed after using the clear command, actually entered before clearing the command but that were not yet shown to the user.

clear what-just-happened pcap-files

	clear what-just-happened pcap-files [all \| user \| auto-export] Deletes what-just-happened pcap files.
Syntax Description	all	All PCAP files
	auto-export	PCAP files with wjh_auto_export prefix
	user	PCAP files with wjh_user prefix
Default	all pcap files
Configuration Mode	config
History	3.8.2000
Role	Admin
Example	switch (config) # clear what-just-happened pcap-files user
Related Commands	file tcpdump delete
Notes	All—all pcap files. User—pcap files with wjh_user prefix. Auto—exportpcap files with wjh_auto_export prefix.

snmp-server notify event what-just-happened

	snmp-server notify event what-just-happened [interval <interval>] [max-traps <max-traps>] no snmp-server notify event what-just-happened [interval <interval>] [max-traps <max-traps>] Enables sending SNMP traps for what-just-happened last events, sets the interval in which traps will be issued, and limits the maximum number of issued traps per interval. The no form of the command disables sending SNMP traps for what-just-happened last events.
Syntax Description	interval	The interval in which traps will be issued. Default: 60 seconds Max: 300 seconds Min: 30 seconds
	max-traps	The maximum number of issued traps per interval. Default: 50 events Max: 100 events Min: 5 events
Default	Disabled
Configuration Mode	config
History	3.9.2000
Example	switch (config) # snmp-server notify event what-just-happened interval 30 max-traps 100
Related Commands	show snmp events what-just-happened
Notes	In case SNMP traps for what-just-happened are enabled while using the CLI, a notification will appear informing that SNMP is running in parallel and of the what-just-happened buffer clearing this command is only relevant for "aggregated" What-Just-Happened events

show what-just-happened

Example
	show what-just-happened [all \| acl \| forwarding \| buffer \| layer-1 \| max-packets <1-1024 per group/1-4096 for all> \| export <file-name> \| no-metadata] Displays dropped packets information.
Syntax Description	acl	Access-list drops
	forwarding	Drop group containing L2, L3, port and tunnel related drops
	buffer	Buffer overflow drops
	layer-1	Drop group containing layer 1 event
	max-packets	Limit number of packets to dump: <1-1024> for forwarding/acl/buffer/layer-1, <1-4096> for all Default: 1024 per group, 4096 for all
	export	Create a pcap file
	file name	Optional file-name for pcap file Default: wjh_user_[group]_[date].pcap
	no-metadata	Do not add metadata to the pcap file (applicable only with 'export' attribute set)
Default	N/A
Configuration Mode	Any command mode
History	3.7.0000
	3.7.1100	Updated syntax and example
	3.8.1000	Updated syntax, default, and example
	3.8.2000	New ACL example
	3.8.2100	Update example
	3.9.0300	Updated example
	3.9.0500	Added layer-1 and buffer drops. PCAP file will not be created by default and updated example
	3.9.0900	Updated ACL example
	3.9.2000	Updated example of show what-just-happened buffer
switch (config) # show what-just-happened --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------# Timestamp sPort dPort VLAN sMAC dMAC EthType Src IP:Port Dst IP:Port IP Proto Drop Group Severity Drop Reason - Recommended Action --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------1 2020/03/31 16:19:51.075 Eth1/3 N/A 12 ba:1b:25:11:22:31 24:8a:07:ca:cd:c8 IPv4 10.10.10.0:6857 10.10.20.1:767 TCP Forwarding Warning Blackhole route - Validate routing table for this (phonebook) destination IP...
Example (acl)
switch (config) # show-what-just-happened acl -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------# Timestamp sPort dPort VLAN sMAC dMAC EthType Src IP:Port Dst IP:Port IP Proto Drop Group Severity Drop Reason - Recommended Action -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------1 2020/05/07 12:25:02.600 Eth1/3 N/A N/A ba:1b:25:0a:0a:0b ba:1b:25:0B:0f:01 LPBK N/A:N/A N/A:N/A N/A Access-list Notice user-access-list - Validate ACL configuration Rules Info------------------------------------------------------------------------------------------------------------------# Table Name Rule ------------------------------------------------------------------------------------------------------------------1 user-access-list seq-number 11 deny ba:1b:25:0a:0a:0b mask ff:ff:ff:ff:ff:ff any Exception list:Buffer group is enabled but not operational. Please configure port recirculation.
Example (acl export)
switch (config) # show what-just-happened acl export Pcap file path : /vtmp/wjh-pcaps/wjh_user_acl_2020_02_20_11_05_55.pcap ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------# Timestamp sPort dPort VLAN sMAC dMAC EthType Src IP:Port Dst IP:Port IP Proto Drop Group Severity Drop Reason - Recommended Action ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------1 2020/02/20 11:03:17.465 Eth1/3 N/A N/A ba:1b:25:0a:0a:0a ba:1b:25:0b:0b:0b LPBK N/A:N/A N/A:N/A N/A Access-list Notice mac-acl - Validate ACL configuration
Example (Layer-1)
switch (config) # show what-just-happened layer-1 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------# Timestamp sPort dPort VLAN sMAC dMAC EthType Src IP:Port Dst IP:Port IP Proto Drop Group Severity Drop Reason - Recommended Action ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- 1 2020/03/16 12:10:58.728 Eth1/15 N/A N/A N/A N/A N/A N/A:N/A N/A:N/A N/A Layer-1 Warning General L1 event - Check layer 1 aggregated information
show what-just-happened all export
show (config) # show what-just-happened all export wjh_example Pcap file path : /vtmp/wjh-pcaps/wjh_ example _all_2020_01_26_10_44_55.pcap ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- # Timestamp sPort dPort VLAN sMAC dMAC EthType Src IP:Port Dst IP:Port IP Proto Drop Group Severity Drop Reason - Recommended Action ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 1 2020/01/26 10:44:29.810 Eth1/1 N/A 10 ba:1b:25:11:22:31 24:8a:07:ca:cd:c8 IPv4 10.10.10.0:54401 10.10.20.1:80 (http) TCP ACL Info Openflow Table 1 - Check Openflow Rule2 2020/01/26 11:44:29.810 Eth1/2 N/A 20 ee:2b:85:61:22:31 11:2e:ff:ca:cd:d3 IPv4 20.20.20.0:10001 10.10.20.1:80 (http) TCP ACL Info mac-acl - Check ACL Rule Rules Info----------------------------------------------------------------------# Table Name Rule ----------------------------------------------------------------------1 Openflow Table 1 ip,ip_dst=10.10.20.1/32,priority=772 mac-acl seq-number 10 deny ee:2b:85:61:22:31 mask ff:ff:ff:ff:ff:ff any
show what-just-happened buffer
switch (config) # show what-just-happened buffer-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------# Timestamp sPort dPort VLAN sMAC dMAC EthType Src IP:Port Dst IP:Port IP Proto Drop Group Severity Drop Reason - Recommended Action -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------1 2020/10/05 12:23:12.464 Eth1/4 Eth1/2 N/A 98:03:9b:82:bF:7a b8:59:9f:a6:69:88 IPv4 10.1.2.2:50876 10.1.1.2:2221 (null) Buffer Notice Port TC Congestion Threshold Crossed - Monitor (rockwell-csp1) network congesti2 2020/10/05 12:23:12.459 Eth1/4 Eth1/2 N/A 98:03:9b:82:bF:7a b8:59:9f:a6:69:88 IPv4 10.1.2.2:50876 10.1.1.2:2221 (null) Buffer Notice Port TC Congestion Threshold Crossed - Monitor (rockwell-csp1) network congestion3 2020/10/05 12:23:12.448 Eth1/4 Eth1/2 N/A 98:03:9b:82:bF:7a b8:59:9f:a6:69:88 IPv4 10.1.2.2:50876 10.1.1.2:2221 (null) Buffer Notice Port TC Congestion Threshold Crossed - Monitor (rockwell-csp1) network congestionBuffer Info: ----------------------------------------------------------------------------------------------------------- # TC Id TC Usage [KB] Latency [nanoseconds] TC Watermark [KB] Latency Watermark [nanoseconds] ----------------------------------------------------------------------------------------------------------- 1 1 2896 N/A N/A N/A 2 1 2960 N/A N/A N/A 3 1 2920 N/A N/A N/A
Related Commands	show what-just-happened status
Notes	By default, pcap file will not be created, if "export" is not specified. Pcap file names will be “wjh_user_[date].pcap” if no user-defined name is entered, and “[user defined name]_[date].pcap” if provided In Spectrum systems, in order to see buffer drops, one interface must be configured as a recirculation port "max-num" and "last-read" are reserved and cannot be used as filenames For display of ACL drops, lines indexes in "Rules Info" table match the indexes in the main table To display buffer drops, lines indexes in "Buffer Info" table should match the indexes in the main table

show what-just-happened aggregated

Example (Layer-1)
	show what-just-happened aggregated <acl \| forwarding \| buffer \| layer-1> <max-num \| last-read> Displays aggregation record.
Syntax Description	max-num	Maximum number of aggregated record displayed.
	last-read	Get aggregated record in last show command
	forwarding	Display aggregated record on layer-2/port/layer-3/tunneling related reasons. Max-num is 192.
	acl	Display aggregated record on access list related reasons. Max-num is 64.
	buffer	Max: 64
	layer-1	Display aggregated record on layer-1 related reasons. Max-num is 256.
Default	N/A
Configuration Mode	Any command mode
History	3.9.0300
	3.9.0500	Added support for ACL, forwarding, and buffer drops
	3.9.0900	Updated ACL example
	3.9.1000	In "show-what-just-happened aggregated acl" added support for description of ACL OpenFlow drops
	3.9.2000	Updated example of show what-just-happened aggregated buffer
switch (config) # show what-just-happened aggregated layer-1 Sample Window : 2020/03/19 05:12:54.086 - 2020/03/19 05:47:43.426 --------------------------------------------------------------------------------------------------- Port State Down Reason - Recommended Action State Change Symbol Error FCS Error --------------------------------------------------------------------------------------------------- Eth1/4 Down Port admin down - Validate port 1 0 0 configuration
Example (acl)
switch (config) # sh what-just-happened aggregated acl Sample Window : 2020/05/11 10:25:09.953 - 2020/05/11 10:55:11.921--------------------------------------------------------------------------------------------------------------------------------------------------------------------# sPort VLAN sMAC dMAC EthType Src IP:Port Dst IP:Port IP Proto Count Severity Drop Reason - Recommended Action --------------------------------------------------------------------------------------------------------------------------------------------------------------------1 Eth1/2 N/A ba:1b:25:0a:0a:0a ba:1b:25:0b:0b:0b LPBK N/A:N/A N/A:N/A N/A 2 Notice mac-acl - Validate ACL configuration Rules Info------------------------------------------------------------------------------------------------------------------# Table Name Rule ------------------------------------------------------------------------------------------------------------------1 mac-acl seq-number 10 deny ba:1b:25:0a:0a:0a mask ff:ff:ff:ff:ff:ff any
Example (forwarding)
switch (config) # show what-just-happened aggregated forwarding Sample Window : 2020/03/16 12:10:29.226 - 2020/03/17 02:33:06.337 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------# sPort VLAN sMAC dMAC EthType Src IP:Port Dst IP:Port IP Proto Count Severity Drop Reason - Recommended Action----------------------------------------------------------------------------------------------------------------------------------------------------------------------------1 Eth1/2 N/A 24:8a:07:97:32:e2 33:33:00:00:00:16 IPv6 [fe80::268a:7ff:fe97:32e2]:N/A [ff02::16]:N/A N/A 2 Notice Ingress spanning tree filter- Expected behavior
Example (buffer)
switch (config) # show what-just-happened aggregated buffer last-readSample Window : 2020/10/05 12:36:49.369 - 2020/10/05 12:38:13.605------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------# sPort VLAN sMAC dMAC EthType Src IP:Port Dst IP:Port IP Proto Count Severity Drop Reason - Recommended Action ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------1 Eth1/4 N/A 98:03:9b:82:bF:7a b8:59:9f:a6:69:88 IPv4 10.1.2.2:50888 10.1.1.2:2221 TCP 6330 Notice Port TC Congestion Threshold Crossed - Monitor network (rockwell-csp1) congestionBuffer Info: ----------------------------------------------------------------------------------------------------------- # TC Id TC Usage [KB] Latency [nanoseconds] TC Watermark [KB] Latency Watermark [nanoseconds] ----------------------------------------------------------------------------------------------------------- 1 N/A N/A N/A 371 N/A
Related Commands
Notes	For display of ACL drops, lines indexes in "Rules Info" table match the indexes in the main table To display buffer drops, lines indexes in "Buffer Info" table should match the indexes in the main table

show what-just-happened status

	Show general what-just-happened status Enables and disables what-just-happened drop-groups status.
Syntax Description	N/A
Default	N/A
Configuration Mode	Any command mode
History	3.8.2000
	3.9.0600	Added operational status
	3.9.1300	Updated output
	3.9.2000	Updated example, adding "Enabled Severities" and "Operational status" fields
Role	Admin
Example	switch (config) # show what-just-happened statusWhat-just-happened is enableSeverities:N: NoticeW: WarningE: Error------------------------------------------------------------------------------------Drop group Admin status Enabled Severities Operational status Auto-export status------------------------------------------------------------------------------------Forwarding Enable W, E Enable EnableAccess-list Enable All Enable EnableBuffer Enable N Enable EnableLayer-1 Enable All Enable N/A
Related Commands
Notes

show snmp events what-just-happened

	show snmp events what-just-happened Displays what-just-happened SNMP configuration and status.
Syntax Description	N/A
Default	N/A
Configuration Mode	Any command mode
History	3.9.2000
Example	switch (config) # show snmp events what-just-happenedEvent : Periodic SNMP traps reporting what-just-happened aggregated dataTrap enabled : YesPolling interval (sec) : 30Maximum traps per interval: 100switch (config) # show snmp events what-just-happenedEvent : Periodic SNMP traps reporting what-just-happened aggregated dataTrap enabled : NoPolling interval (sec) : N/AMaximum traps per interval: N/A
Related Commands	snmp-server notify event what-just-happened
Notes

Configure WJH Events

switchmode exceptions sip-equals-dip

	switchmode exceptions sip-equals-dip no switchmode exceptions sip-equals-dip Cancels the discard on this trap. The no form of the command returns the action to discard for this trap.
Syntax Description	N/A
Default	Disabled
Configuration Mode	Config
History	3.9.0900
Example	switch (config) # switchmode exceptions sip-equals-dip
Related Commands	show switchmode exceptions
Notes

show switchmode exceptions

	show switchmode exceptions Shows the current state of the exceptions
Syntax Description	N/A
Default	N/A
Configuration Mode	Config
History	3.9.0900
Example	switch (config) # show switchmode exceptionsSrc & Dest IP equal action: Forward
Related Commands	switchmode exceptions sip-equals-dip
Notes

Last updated: December 20, 2021