Cisco Support Community

How to perform traffic capture on ISR GW

Here we will be utilising the trafiic export feature which has been in use from IOS 12.3(4)T

The IP Traffic Export feature allows users to  configure their router to export IP packets that are received on  multiple, simultaneous WAN or LAN interfaces. The unaltered IP packets  are exported on a single LAN or VLAN interface, thereby, easing  deployment of protocol analyzers and monitoring devices.

Here's the configuration we need


conf t

access-list 101 permit ip any any

! Make sure you do not change an existing ACL, if required - create a

new one with different number.

ip traffic-export profile pcap_1 mode capture bidirectional incoming

access-list 101 outgoing access-list 101 exit

interface <Ethernet interface - or any other interface pointing to SIP

SP> ip traffic-export apply pcap_1 size 9000000

!This captures 9 MB of data.

Clear buffer (before test start):


traffic-export interface <Ethernet interface> clear

Making the captures:


traffic-export interface <Ethernet interface> start

3. start a call

4. once the call ends , execute the below cli to stop the capture

traffic-export interface <Ethernet interface> stop

5. copy the traces  to  TFTP or FTP server as:

traffic-export interface <Ethernet interface> copy ftp:


The export feature will get us capture on SP side.