Skip to content

Preparing Captures

Israel Fernandez edited this page Aug 19, 2026 · 1 revision

These are the files nettopo collect produces, in exactly this format — this page is for when you are saving them by hand instead.

The -i/--input directory holds one text file per device. Each file concatenates the outputs of several show commands, each preceded by that device's prompt line (hostname#show ...) — this is how nettopo both identifies the device as a source device (as opposed to one only ever mentioned by a neighbor) and splits the file back into per-command sections. tests/fixtures/captures/ has worked examples. Files are read as utf-8-sig, so a leading UTF-8 BOM is handled transparently.

Which commands each subcommand needs

Nothing is mandatory: a missing command means the data it feeds is simply absent (empty CSV columns, missing links, a view with nothing to draw), never an error. The table below is what each subcommand needs to produce a complete result.

Subcommand Required Optional, adds
parse — every command in the next table; each fills its own CSV table or columns
l2 show cdp neighbors detail and/or show lldp neighbors detail show version (device naming) · show etherchannel summary / show port-channel summary (only for --link-mode port-channel)
stp show spanning-tree and show cdp neighbors detail / show lldp neighbors detail show version (device naming) · show etherchannel summary / show port-channel summary (required when links are bundled) · show lldp neighbors detail (to identify a root bridge outside the captures)
hsrp show standby brief show ip interface brief / show interfaces (each member's own SVI address on its node) · show version (device naming)
bgp show ip bgp summary show ip interface brief / show interfaces (matches a peer's address to a captured router, so one session is drawn as one link) · show version (device naming)
all — everything in this table; each view it finds no data for is skipped with a warning

stp needs CDP/LLDP too. show spanning-tree reports a device's own bridge and port roles/states, but never says who is on the other end of a port — on its own it yields nodes and no edges. The STP view draws its links from the CDP/LLDP topology and labels each end with the spanning-tree state found there, so without a neighbor discovery command you get a diagram of disconnected boxes.

stp needs the bundle table when links are bundled. The join between the two sources above is the interface name, and for a port-channel the two sources disagree: spanning-tree only ever says Po1, CDP/LLDP only ever say Gi1/0/1. show etherchannel summary (or show port-channel summary) is what maps one to the other. Without it, a fully bundled network produces the same disconnected boxes — every switch drawn, not one line between them.

What each command contributes

Whichever subcommand you run:

show command Fills
show version platform, model, os and serial in devices.csv, and the canonical hostname every neighbor's spelling is correlated onto — without it that name falls back to the prompt line, which is usually the same
show cdp neighbors detail Links between devices (neighbors.csv, and the links in both the L2 and STP diagrams), plus each neighbor's role/icon, platform and management IP
show lldp neighbors detail The same, for neighbors that don't speak CDP. Where both describe one adjacency, CDP wins
show ip interface brief interfaces.csv: admin/operational state and IP per interface — including the SVI addresses the HSRP diagrams label their routers with
show interfaces interfaces.csv: descriptions, precise IP/prefix, link state. Richer than show ip interface brief and wins where the two overlap
show vlan brief vlans.csv
show spanning-tree stp.csv and the STP diagrams: bridge IDs, base and effective priority, per-port role/state
show standby brief hsrp.csv and the HSRP diagrams: each group's virtual IP, and each member's SVI, priority, role and preempt flag
show ip bgp summary bgp.csv and the BGP diagram: each session's peer address, both AS numbers, its state and whether it is iBGP or eBGP — plus the device's own asn and router_id in devices.csv
show etherchannel summary (IOS/IOS-XE) · show port-channel summary (NX-OS) po_id/po_members in interfaces.csv, and the bundles l2 --link-mode port-channel collapses links onto

A capture covering everything implemented today:

sw1-access#show version
...
sw1-access#show cdp neighbors detail
...
sw1-access#show lldp neighbors detail
...
sw1-access#show ip interface brief
...
sw1-access#show interfaces
...
sw1-access#show vlan brief
...
sw1-access#show spanning-tree
...
sw1-access#show standby brief
...
sw1-access#show etherchannel summary
...
sw1-access#show ip bgp summary
...

Three things that trip captures up

  • Run each command with no arguments. A prompt line has to match the command in full, so show spanning-tree vlan 10 is not recognized as show spanning-tree and that section is skipped silently. Capture the unfiltered output and let nettopo do the per-VLAN split.
  • Abbreviations are fine. show ver, show cdp neigh det, show ip int br and show span all match, so a capture taken by typing short forms works as-is.
  • One section per command per file. Only the first matching section is read; a command captured twice contributes its first occurrence only.

The prompt line drives all of this, so keep it — the filename is only a fallback for naming a device whose file has no prompt line at all. Both hostname# and hostname> work.

Clone this wiki locally