Packet Capture From Cisco Router

7K

ethanalyzer local interface inband limit-captured-frames 20000 autostop duration 120 write bootflash:capture.pcap

IOS-XE Router

monitor capture CAP int Gi0/0/1 both

monitor capture CAP match ipv4 any any

monitor capture CAP start

show monitor capture CAP buffer brief

monitor capture CAP stop

monitor capture CAP export ftp://10.1.10.27/CAP.pcap

no monitor capture CAP

IOS Router

1. create access-list for packet filter
access-list 1 permit 10.100.1.45
2. create buffer
monitor capture buffer holdpackets
3. filter buffer
monitor capture buffer holdpackets filter access-list 1
4. create capture point
monitor capture point ip cef mytrace all both
5. associate capture point with buffer
monitor capture point associate mytrace holdpackets
6. start capture
monitor capture point start mytrace
• Look at progress
show monitor capture buffer all parameters
• See list of capture points
show monitor capture point all
7. Stop the capture
monitor capture point stop mytrace
8. Export buffer as PCAP
monitor capture buffer holdpackets export tftp://10.1.10.27/mytrace.pcap
9. Remove buffer
no monitor capture buffer holdpackets
10. Remove capture point
no monitor capture point ip cef mytrace all both