The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
Cisco IOS Embedded Packet Capture (EPC) is an onboard packet capture facility that allows network administrators to capture packets flowing to, through or from the device and to analyze them locally or save and export them for offline analysis using a tool like Wireshark. This feature simplifies operations by allowing the devices to become active participants in the management and operation of the network. This feature facilitates better troubleshooting by gathering information on packet format. It also facilitates application analysis and security.
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
The EPC software subsystem consumes CPU and memory resources in its operation. You must have adequate system resources for different types of operations. Some guidelines for arranging the system resources are provided in the table below.
Table 1 | System Requirements for EPC subsystem |
Hardware |
CPU utilization requirements are platform dependent. |
Memory |
The packet buffer is stored in DRAM. The size of the packet buffer is user specified. |
Diskspace |
Packets can be exported to external systems. No intermediate storage on flash disk is required. |
EPC provides a better level of embedded systems management that helps in tracing and troubleshooting packets. This feature allows network administrators to capture data packets flowing through, to, and from a Cisco router.
Some of the benefits of this feature include:
The capture buffer is an area in memory for holding the packet data. You can specify unique names, size and type of the buffer, and configure the buffer to handle incoming data as required.
The following types of data are stored in a capture buffer:
The packet data starts from datagramstart and copies a minimum of the per-packet-capture size or datagramsize to the capture buffer.
The metadata contains descriptive information about a set of packet data. It contains:
The following actions can be performed on capture buffers:
The capture point is a traffic transit point where a packet is captured and associated with a buffer. You can define capture points by providing unique names and different parameters.
The following capture points are available:
You can perform the following actions on the capture point:
Perform this task to start capturing packet data for analysis and troubleshooting. To capture packet data, a capture buffer and a capture point need to be defined. The capture point should then be associated with the capture buffer. Enabling the capture point will start the process of capturing packet data.
Perform this task to stop capturing packet data.
Perform this task to export the packet data for analysis using an external tool.
Perform this task to monitor and maintain the packet data captured. Capture buffer details and capture point details can be displayed.
The following example shows how to capture packets to and from Fast Ethernet 0/1 interface:
Router> enable Router# monitor capture buffer pktrace1 ip cef ipceffa0/1 fastEthernet 0/1 both Router# monitor capture point associate ipceffa0/1 pktrace1 Router# monitor capture point start ipceffa0/1 Mar 21 11:13:34.023: %BUFCAP-6-ENABLE: Capture Point ipceffa0/1 enabled. Router# show monitor capture point all Status Information for Capture Point ipceffa0/1 IPv4 CEF Switch Path: IPv4 CEF , Capture Buffer: pktrace1 Status : Inactive Configuration: monitor capture point ip cef ipceffa0/1 FastEthernet0/1 both Router# show monitor capture buffer all Capture buffer pktrace1 (circular buffer) Buffer Size : 262144 bytes, Max Element Size : 256 bytes, Packets : 31 Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0 Associated Capture Points: Name : ipceffa0/1, Status : Active Configuration: monitor capture buffer pktrace1 size 256 max-size 256 circular monitor capture point associate ipceffa0/1 pktrace1
The following example shows how to stop capturing packet data:
Router> enable Router# monitor capture point stop ipceffa0/1 Mar 21 11:14:20.152: %BUFCAP-6-DISABLE: Capture Point ipceffa0/1 disabled.
The following example shows how to export data for analysis through an external tool:
Router> enable Router# monitor capture buffer pktrace1 export tftp://10.1.88.9/pktrace1
The EPC feature provides the ability to dump packets in ASCII. The following example shows an IPv4 ICMP echo reply packet from one host to another:
<timestamp>: IPv4 packet received on Ethernet0/0 in the IPv4 CEF LES switch path 029E28E0: AABBCC01 2D00AABB CC013000 08004500 *;L.-.*;L.0...E. 029E28F0: 00640001 0000FE01 A8950A00 00020A00 .d....~.(....... 029E2900: 00010000 D5C80001 00000000 00000000 ....UH.......... 029E2910: B080ABCD ABCDABCD ABCDABCD ABCDABCD 0.+M+M+M+M+M+M+M 029E2920: ABCDABCD ABCDABCD ABCDABCD ABCDABCD +M+M+M+M+M+M+M+M 029E2930: ABCDABCD ABCDABCD ABCDABCD ABCDABCD +M+M+M+M+M+M+M+M 029E2940: ABCDABCD ABCDABCD ABCDABCD ABCDABCD +M+M+M+M+M+M+M+M 029E2950: ABCD
The following example shows how to view the contents of the capture buffer pktrace1. This output is displayed using the show monitor capture buffer capture-buffer-name dump command. This command supports two modes: the default mode and the dump mode. In the dump mode, the hexadecimal dump of the captured packet is also shown.
Router> enable Router# show monitor capture buffer pktrace1 dump 11:13:00.593 EDT Mar 21 2007 : IPv4 Turbo : Fa2/1 Fa0/1 65B6F500: 080020A2 44D90009 E94F8406 08004500 .. "DY..iO....E. 65B6F510: 00400F00 0000FE01 92AF5801 13025801 .@....~../X...X. 65B6F520: 58090800 4D1A1169 00000000 0005326C X...M..i......2l 65B6F530: 01CCABCD ABCDABCD ABCDABCD ABCDABCD .L+M+M+M+M+M+M+M 65B6F540: ABCDABCD ABCDABCD ABCDABCD ABCD00 +M+M+M+M+M+M+M. 11:13:20.593 EDT Mar 21 2007 : IPv4 Turbo : Fa2/1 Fa0/1 65B6F500: 080020A2 44D90009 E94F8406 08004500 .. "DY..iO....E. 65B6F510: 00400F02 0000FE01 92AD5801 13025801 .@....~..-X...X. 65B6F520: 58090800 FEF91169 00000000 0005326C X...~y.i......2l 65B6F530: 4FECABCD ABCDABCD ABCDABCD ABCDABCD Ol+M+M+M+M+M+M+M 65B6F540: ABCDABCD ABCDABCD ABCDABCD ABCDFF +M+M+M+M+M+M+M
The following example shows how to enable the packet capture infra debugs:
Router> enable Router# debug packet-capture Buffer Capture Infrastructure debugging is on
Related Topic |
Document Title |
---|---|
Cisco IOS commands |
|
Network Management commands (including EEM commands): complete command syntax, defaults, command mode, command history, usage guidelines, and examples. |
Cisco IOS Network Management Command Reference |
Standard |
Title |
---|---|
No new or modified standards are supported, and support for existing standards has not been modified. |
-- |
MIB |
MIBs Link |
---|---|
No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature. |
To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: |
RFC |
Title |
---|---|
No new or modified RFCs are supported, and support for existing RFCs has not been modified. |
-- |
Description |
Link |
---|---|
The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password. |
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 2 | Feature Information for Embedded Packet Capture |
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.