cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
263
Views
1
Helpful
5
Replies

Embedded PCAP Question About File Location

whales4u
Level 1
Level 1

First time working with EPC. Here's the command I'm using below.

monitor capture pcapname access-list pcapACL interface int# both file location flash:filename.pcap buffer 20

I have a couple questions. First question, even though I'm stating the file to flash: when I check show monitor capture the Associated file name: bootflash:filename.pcap 

Why isn't the file going to the flash: as stated in command?

 

Second question, am I not able to use a circular buffer when I'm stating a file location? I'm assuming I would have to export the circular buffer as it isn't constantly rewriting the file so it won't save to a file location. 

 

Please let me know. 

5 Replies 5

You use flash not bootflash?

MHM

is bootflash preferred over flash for file location? why?

what platform you have ?

MHM

C9500-48Y4C

Version 17.09.04a

 

whales4u
Level 1
Level 1

Answer to my second question about circular buffer from Embedded Packet Capture documentation.

 

This step generates swap files in the
controller. Swap files are not packet
capture (PCAP) files, and therefore,
cannot be analyzed. When the export
command is run, the swap files are
combined and exported as one PCAP
file.

Review Cisco Networking for a $25 gift card