Symptom
If Embedded Packet Capture / Embedded Wireshark feature is activated on an interface running MACSec encryption, the following errors will start appearing in the logs:
*Feb 9 12:37:09: %SYS-2-INPUT_GETBUF: Bad getbuffer, bytes= 65522, for interface= Vlan10 -Process= "", ipl= 2
-Traceback= 1#7d349a90369f7b51ceb9a1dcd01c5069 :5640051A6000+6F0EDAE :5640051A6000+6F0F03E :5640051A6000+34A290C :5640051A6000+71DB8FB :5640051A6000+71D2D0D :5640051A6000+3493542 :5640051A6000+349808A iosd_crb_ngwc_unix:7F30DDEC8000+6754C prelib:7F3165E20000+38AC prelib:7F3165E20000+38AC
*Feb 9 12:35:36: %IOSXE_INFRA-3-PUNT_SVC_TYPE_UNKNOWN: Punted packet with unknown service type 1
Conditions
C9400 switch running IOS-XE 17.3.6
No noticeable impact due to these errors.
Further Problem Description
EPC capture can become corrupted once these errors start appearing after some time (e.g. if the Circular EPC is run for just 5 minutes, it works fine. But Circular EPCs running longer than 10 minutes will fail).
If an interface is running both encrypted and non-encrypted traffic, both will be corrupted.
For example, this output shows bogus MAC addresses, ethertypes and lenghts:
Switchj#show mon cap TAC buff br
Starting the packet display ........ Press Ctrl + Shift + 6 to exit
1 0.000000 ea:71:1a:78:14:39 b^F^R 48:20:c2:c8:3f:8c 0xb5ce 21498 Ethernet II
2 350501237.674556 46:2a:44:8c:dc:95 b^F^R 51:41:03:e8:86:92 0xd570 56661 Ethernet II
3 1170921457.310149 a7:8c:be:5d:e6:6f b^F^R 06:45:8d:6c:46:44 0x7a91 26480 Ethernet II
4 881285414.656683 bf:3f:f1:ad:45:ce b^F^R 59:c2:90:9c:0f:75 0xf56d 31696 Ethernet II
5 875849091.239714 cc:d5:b4:a1:0f:b8 b^F^R 13:1c:1f:31:5c:12 0xb011 2119 Ethernet II
