Packet capture on router

Packet capture on router

  November 19, 2015    Raj

---

1.Define a 'capture buffer' with the specified name
monitor capture buffer mycap size 2048 max-size 4000 circular

2. Specify access-list
ip access-list ex mycap
permit ip host
permit ip host


monitor capture buffer mycap filter access-list mycap

3. Defines a capture point
monitor capture point ip cef cap fastEthernet 1/0 both

4. Attach capture point with the capture buffer specified.
monitor capture point associate cap mycap

5. Enables the capture point to start capturing packet data:
monitor capture point start cap



Now the capture is enabled and allows collecting necessary data as configure in ACL

To disable the capture point and stops the packet data capture process use following command:
monitor capture point stop cap

How to see the capture:
==============================
show monitor capture buffer all parameters

Send it to TFTP :
monitor capture mycap export tftp://1.1.1.2//Capture.pcap 


=================
All commands at once, just copy and paste:
=================
!
conf t
!
ip access-list ex mycap
permit ip host
permit ip host
!
exit
exit
!
monitor capture buffer mycap size 2048 max-size 4000 circular
!      
monitor capture buffer mycap filter access-list mycap
!  
monitor capture point ip cef cap fastEthernet 1/0 both 
!
monitor capture point associate cap mycap
!
monitor capture point start cap
!
==========================================================