Embedded Packet Capture failing to export

[KMNRuser]

I am using the Embedded Packet Capture feature on a C8200L-1N-4T router.

I have the capture and need to export it to our TFTP server.

When i run the following command:

8200_RTR#mon cap DMVPN export tftp://192.168.1.146/Community.pcap

I get the following result:

.....
Failed to Export : Failed to create export file

What could be the cause of this?  I have sniffer running on the TFTP box set to udp port 69 but i am not seeing any traffic coincide..

Thank you in advance for any input here!

KMNRUser

[M02@rt37]

Hello @KMNRuser 

C8200 send packet sourced with which IP ? From this IP, does the TFTP server [192.168.1.146] is reachable ?

[balaji.bandi]

Can you try is the PCAP can able to store in Flash ?

Try copy any config to TFTP see is that TFTP works ?

other option have you tried :

monitor capture export destination tftp://x.x.x.x/pcap.cap

[MHM Cisco World]

Copy to flash first 

Then from flash to tftp server.

Try this way

MHM

[KMNRuser]

I am not sure where the Cisco router 8200 is storing the capture!

It does not appear to be in bootflash:

ODEC_COMM_RTR#dir
Directory of bootflash:/

360449 drwx 53248 Dec 8 2023 09:54:35 -05:00 tracelogs
253953 drwx 4096 Sep 22 2023 15:15:57 -04:00 license_evlog
17 -rw- 30 Sep 22 2023 15:15:27 -04:00 throughput_monitor_params
14 -rw- 134935 Sep 22 2023 15:15:20 -04:00 memleak.tcl
12 -rw- 1456 Sep 22 2023 15:14:49 -04:00 mode_event_log
188417 drwx 4096 Sep 22 2023 15:14:24 -04:00 .installer
81921 drwx 4096 Sep 22 2023 15:14:11 -04:00 sysboot
344065 drwx 4096 Sep 19 2023 09:18:24 -04:00 .geo
73729 drwx 4096 Sep 19 2023 09:18:20 -04:00 .prst_sync
352257 drwx 4096 Sep 19 2023 09:14:29 -04:00 .dbpersist
286721 drwx 4096 Sep 19 2023 08:03:05 -04:00 pnp-tech
19 -rw- 248 Sep 19 2023 08:01:06 -04:00 .iox_dir_list
335873 drwx 4096 Jul 6 2023 09:18:29 -04:00 fw_upgrade_sysinfo
57345 drwx 4096 Jul 6 2023 09:15:39 -04:00 iox_host_data_share
180225 drwx 4096 Jul 6 2023 09:15:33 -04:00 core
434177 drwx 4096 Jul 6 2023 09:15:19 -04:00 guest-share
401409 drwx 4096 Jul 6 2023 09:15:12 -04:00 onep
245761 drwx 4096 Jul 6 2023 09:15:11 -04:00 pnp-info
18 drwx 4096 Jul 6 2023 09:13:26 -04:00 lost+found
376833 drwx 4096 May 30 2023 11:57:10 -04:00 virtual-instance
16 -rwx 1314 May 30 2023 11:57:05 -04:00 trustidrootx3_ca.ca
15 -rw- 20109 May 30 2023 11:57:05 -04:00 ios_core.p7b
229377 drwx 4096 May 30 2023 11:56:50 -04:00 ss_disc
13 -rw- 5242880 May 30 2023 11:56:50 -04:00 ssd
237569 drwx 4096 May 30 2023 11:56:35 -04:00 .ssh
139265 drwx 4096 May 30 2023 11:56:29 -04:00 .rollback_timer
11 -rw- 804748616 May 30 2023 11:51:05 -04:00 c8000be-universalk9.17.06.01a.SPA.bin

7693897728 bytes total (5698883584 bytes free)
ODEC_COMM_RTR#

Where is the file?  I have to find it first before i can move it to flash to try the TFTP..

I did a "sho file systems" and then went into each directory.  I still cannot find the capture file, and so far documentation has not led me to where it may be located.

Thank you,

KMNRuser

[MHM Cisco World · Accepted solution]

You need to direct capture to flash 

8200_RTR#mon cap DMVPN export flash 

Then copy flash to tftp.

It not save automatic 

MHM

[KMNRuser]

MHM Cisco World,

Thanks!  I was able to export to bootflash: successfully.

Now when i try to copy bootflash:/<filename.pcap> tftp .. it times out.. i probably am blocking the tftp..i may have to create a rule somewhere to allow the TFTP.

Thanks so much for helping here!

Kevin

[MHM Cisco World]

You are so so welcome Kevin 

Have a nice weekend 

MHM

[Ranghel]

Hello, @MHM Cisco World 

I have the same problem.

I currently have the following scenario.

I have a Router CSR1000v with IP 192.168.239.136 on Int Gi1.

And my Laptop has the IP 192.168.239.1

I am trying to "export" the traffic capture that I have done with the "Monitor capture..." but I have not been able to solve it.

I have exported the monitor capture file, to the CSR1000v flash, following the previous recommendations, but the problem remains.

I have connectivity between both exposed IPs.

My CSR1000v is on a VMware Workstation PRO.

Please can you guide me with a possible solution.

Thanks