12-07-2023 07:35 AM
I am using the Embedded Packet Capture feature on a C8200L-1N-4T router.
I have the capture and need to export it to our TFTP server.
When i run the following command:
8200_RTR#mon cap DMVPN export tftp://192.168.1.146/Community.pcap
I get the following result:
.....
Failed to Export : Failed to create export file
What could be the cause of this? I have sniffer running on the TFTP box set to udp port 69 but i am not seeing any traffic coincide..
Thank you in advance for any input here!
KMNRUser
Solved! Go to Solution.
12-08-2023 07:11 AM
You need to direct capture to flash
8200_RTR#mon cap DMVPN export flash
Then copy flash to tftp.
It not save automatic
MHM
12-07-2023 07:43 AM
Hello @KMNRuser
C8200 send packet sourced with which IP ? From this IP, does the TFTP server [192.168.1.146] is reachable ?
12-07-2023 07:45 AM - edited 12-07-2023 07:46 AM
Can you try is the PCAP can able to store in Flash ?
Try copy any config to TFTP see is that TFTP works ?
other option have you tried :
monitor capture export destination tftp://x.x.x.x/pcap.cap
12-07-2023 07:54 AM
Copy to flash first
Then from flash to tftp server.
Try this way
MHM
12-08-2023 06:58 AM
I am not sure where the Cisco router 8200 is storing the capture!
It does not appear to be in bootflash:
ODEC_COMM_RTR#dir
Directory of bootflash:/
360449 drwx 53248 Dec 8 2023 09:54:35 -05:00 tracelogs
253953 drwx 4096 Sep 22 2023 15:15:57 -04:00 license_evlog
17 -rw- 30 Sep 22 2023 15:15:27 -04:00 throughput_monitor_params
14 -rw- 134935 Sep 22 2023 15:15:20 -04:00 memleak.tcl
12 -rw- 1456 Sep 22 2023 15:14:49 -04:00 mode_event_log
188417 drwx 4096 Sep 22 2023 15:14:24 -04:00 .installer
81921 drwx 4096 Sep 22 2023 15:14:11 -04:00 sysboot
344065 drwx 4096 Sep 19 2023 09:18:24 -04:00 .geo
73729 drwx 4096 Sep 19 2023 09:18:20 -04:00 .prst_sync
352257 drwx 4096 Sep 19 2023 09:14:29 -04:00 .dbpersist
286721 drwx 4096 Sep 19 2023 08:03:05 -04:00 pnp-tech
19 -rw- 248 Sep 19 2023 08:01:06 -04:00 .iox_dir_list
335873 drwx 4096 Jul 6 2023 09:18:29 -04:00 fw_upgrade_sysinfo
57345 drwx 4096 Jul 6 2023 09:15:39 -04:00 iox_host_data_share
180225 drwx 4096 Jul 6 2023 09:15:33 -04:00 core
434177 drwx 4096 Jul 6 2023 09:15:19 -04:00 guest-share
401409 drwx 4096 Jul 6 2023 09:15:12 -04:00 onep
245761 drwx 4096 Jul 6 2023 09:15:11 -04:00 pnp-info
18 drwx 4096 Jul 6 2023 09:13:26 -04:00 lost+found
376833 drwx 4096 May 30 2023 11:57:10 -04:00 virtual-instance
16 -rwx 1314 May 30 2023 11:57:05 -04:00 trustidrootx3_ca.ca
15 -rw- 20109 May 30 2023 11:57:05 -04:00 ios_core.p7b
229377 drwx 4096 May 30 2023 11:56:50 -04:00 ss_disc
13 -rw- 5242880 May 30 2023 11:56:50 -04:00 ssd
237569 drwx 4096 May 30 2023 11:56:35 -04:00 .ssh
139265 drwx 4096 May 30 2023 11:56:29 -04:00 .rollback_timer
11 -rw- 804748616 May 30 2023 11:51:05 -04:00 c8000be-universalk9.17.06.01a.SPA.bin
7693897728 bytes total (5698883584 bytes free)
ODEC_COMM_RTR#
Where is the file? I have to find it first before i can move it to flash to try the TFTP..
I did a "sho file systems" and then went into each directory. I still cannot find the capture file, and so far documentation has not led me to where it may be located.
Thank you,
KMNRuser
12-08-2023 07:11 AM
You need to direct capture to flash
8200_RTR#mon cap DMVPN export flash
Then copy flash to tftp.
It not save automatic
MHM
12-08-2023 08:03 AM
MHM Cisco World,
Thanks! I was able to export to bootflash: successfully.
Now when i try to copy bootflash:/<filename.pcap> tftp .. it times out.. i probably am blocking the tftp..i may have to create a rule somewhere to allow the TFTP.
Thanks so much for helping here!
Kevin
12-08-2023 08:18 AM
You are so so welcome Kevin
Have a nice weekend
MHM
04-18-2024 07:48 AM
Hello, @MHM Cisco World
I have the same problem.
I currently have the following scenario.
I have a Router CSR1000v with IP 192.168.239.136 on Int Gi1.
And my Laptop has the IP 192.168.239.1
I am trying to "export" the traffic capture that I have done with the "Monitor capture..." but I have not been able to solve it.
I have exported the monitor capture file, to the CSR1000v flash, following the previous recommendations, but the problem remains.
I have connectivity between both exposed IPs.
My CSR1000v is on a VMware Workstation PRO.
Please can you guide me with a possible solution.
Thanks
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide