"debug ip packet" help

Answered Question
Apr 25th, 2008

I am having difficulties using "debug ip packet" to capture routed traffic. Does "debug ip packet" capture locally generated/processed traffic only or it captures CEF routed traffic as well? What is the proper command to capture pass through traffic (say input ethernet 0 and output serial 0 without NAT)?

Thanks!

I have this problem too.
0 votes
Correct Answer by Joseph W. Doherty about 8 years 7 months ago

Don't hold me to this, but recall a discussion within these forums that might have mentioned interface route-cache needs to be off to see packets within debug; don't recall mention about CEF.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4 (1 ratings)
Loading.
Correct Answer
Joseph W. Doherty Fri, 04/25/2008 - 16:44

Don't hold me to this, but recall a discussion within these forums that might have mentioned interface route-cache needs to be off to see packets within debug; don't recall mention about CEF.

zhenxu_zj Fri, 04/25/2008 - 17:10

With "detail" or not does not make any difference. The traffic does not show up at all. I think "ip cache" maybe on the right track. I will try and update everyone.

Thanks for the hint.

zhenxu_zj Fri, 04/25/2008 - 17:19

"no ip route-cache" is the resolve. Thanks for the great hint.

Per Cisco:

Before using debugging ip packet, note that the router is doing fast-switching by default, or may be doing CEF switching if configured to do so. This means that, once those techniques are in place, the packet is not provided to the processor, hence the debugging does not show anything. For this to work, you need to disable fast-switching on the router with no ip route-cache (for unicast packets) or no ip mroute-cache (for multicast packets). This should be applied on the interfaces where the traffic is supposed to flow. Verify this with the show ip route command.

http://www.cisco.com/en/US/tech/tk801/tk379/technologies_tech_note09186a008017874c.shtml

Actions

This Discussion