Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Trouble Capturing Packets with Embedded Packet Capture

Hi All,

I am trying to capture packets originating from a server to a host device across three switches:

 

server -- 6513 -- 3850 -- 3550 -- host A

 

I am doing a ping from the server to host A. The packet capture is being done on the 3850. This is my configuration:

 

access-list 100 permit icmp host 192.168.101.6 host 192.168.100.188
access-list 100 permit icmp host 192.168.100.188 host 192.168.101.6
end

 

monitor capture buffer TRACE
monitor capture buffer TRACE filter access-list 100
monitor capture point ip cef CAP g1/1/1 both
montior capture point associate CAP TRACE
monitor capture point start CAP

 

I then issue a ping from the server to host A. Interface g1/1/1 is where the 6513 connects to the 3850. When I issue a show monitor capture buffer all parameters, there are no packets. If I remove the filter from the buffer I still do not see the packets.

Does anyone have any advice here?

Everyone's tags (1)
3 REPLIES
Purple

Hi,Can you post the output of

Hi,

Can you post the output of show monitor capture buffer all

as well as output of  show monitor capture buffer TRACE parameters

And also a sh run int G1/1/1

 

Regards

Alain

Don't forget to rate helpful posts.
New Member

I tried recreating the packet

I tried recreating the packet capture with no access-list filtering.
show mon cap buff all para
Capture buffer cap (circular buffer)
Buffer Size : 1048576 bytes, Max Element Size : 68 bytes, Packets : 0
Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0
Associated Capture Points:
Name : cap, Status : Active
Configuration:
monitor capture buffer cap circular
monitor capture point associate cap cap
 
interface GigabitEthernet1/1/1
 description UPLINK TO 6513
 switchport mode trunk
end

 

Purple

Hi,This feature only works on

Hi,

This feature only works on L3 interfaces as far as I know, if you want to monitor a L2 link then you have to use SPAN or RSPAN feature.

 

Regards

 

Alain

Don't forget to rate helpful posts.
546
Views
0
Helpful
3
Replies
CreatePlease login to create content