EPC provides a better level of embedded systems management that helps in tracing and troubleshooting packets. This feature allows network administrators to capture data packets flowing through, to, and from a Cisco router.

Some of the benefits of this feature include:

• Ability to capture IPv4 and IPv6 packets in the Cisco Express Forwarding (CEF) path.
• A flexible method for specifying the capture buffer parameters.
• Filter captured packets.
• Methods to decode data packets captured with varying degree of detail.
• Facility to export the packet capture in PCAP format suitable for analysis using an external tool.
• Extensible infrastructure for enabling packet capture points.

The capture buffer is an area in memory for holding the packet data. You can specify unique names, size and type of the buffer, and configure the buffer to handle incoming data as required.

The following types of data are stored in a capture buffer:

• Packet data
• Metadata

The packet data starts from datagramstart and copies a minimum of the per-packet-capture size or datagramsize to the capture buffer.

The metadata contains descriptive information about a set of packet data. It contains:

• A timestamp of when it is added to a buffer.
• The direction in which the packet data is transmitted--egress or ingress.
• The switch path captured.
• Encapsulation type corresponding to input or output interface to allow the decoding of L2 decoders.

The following actions can be performed on capture buffers:

• Define a capture buffer and associate it with a capture point.
• Clear capture buffers.
• Export capture buffers for offline analysis. Export writes off the file using one of the supported file transfer options: FTP, HTTP, HTTPS, PRAM, RCP, SCP, and TFTP.
• Display content of the capture buffers.

The capture point is a traffic transit point where a packet is captured and associated with a buffer. You can define capture points by providing unique names and different parameters.

The following capture points are available:

• IPv4 CEF/interrupt switching path with interface input and output
• IPv6 CEF/interrupt switching path with interface input and output

You can perform the following actions on the capture point:

• Associate or disassociate capture points with capture buffers. Each capture point can be associated with only one capture buffer.
• Destroy capture points.
• Activate packet capture points on a given interface. Multiple packet capture points can be made active on a given interface. For example, Border Gateway Protocol (BGP) packets can be captured into one capture buffer and Open Shortest Path First (OSPF) packets can captured into another capture buffer.
• Access Control Lists (ACLs) can be applied to capture points.

1.    enable

2.    monitor capture buffer buffer-name [clear | export export-location | filter access-list {ip-access-list | ip-expanded-list | access-list-name} | limit {allow-nth-pak nth-packet | duration seconds | packet-count total-packets | packets-per-sec packets} | [max-size element-size] [size buffer-size] [circular| linear]]

3.    monitor capture point {ip| ipv6}{cef capture-point-name interface-name interface-type{both | in | out}| process-switched capture-point-name {both| from-us| in | out}}

4.    monitor capture point associate capture-point-name capture-buffer-name

5.    monitor capture point start {capture-point-name | all}

1.    enable

2.    monitor capture point stop {capture-point-name | all}

1.    enable

2.    monitor capture buffer buffer-name export export-location

1.    enable

2.    show monitor capture {buffer {capture-buffer-name [parameters] | all parameters | merged capture-buffer-name1 capture-buffer-name2}[dump] [filter filter-parameters]} | point {all | capture-point-name}}

3.    debug packet-capture