DUMP from remote equipment

[Mlex1]

Hello everyone how to take dump from remote equipment.
link just for older cisco router for-example 1900 etc, i have router asr1001 eps doesn't working
https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-embedded-packet-capture/116045-productconfig-epc-00.html

[Joseph W. Doherty]

Such older equipment didn't originally support EPC.  Possibly, depending how old is old, a later IOS might have added the EPC feature.  If not, we used to place a sniffer, externally, in-line or, if device supported SPAN, direct its output to a packet capture device.

[Mlex1]

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5500/sw/system_management/7x/b_5500_System_Mgmt_Config_7x/configuring_span.pdf

this one? am i right 

[Joseph W. Doherty]

---

@Mlex1 wrote:

https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5500/sw/system_management/7x/b_5500_System_Mgmt_Config_7x/configuring_span.pdf

this one? am i right 

---

You're on the right track.  SPAN support does vary per platform, and there a 3 variants, see https://learningnetwork.cisco.com/s/article/span-rspan-erspan.

[Mlex1]

i found another option without settings SPAN 

steps 
in new equipment, here it's up to us any interface ACL, etc
monitor capture TEST-DUMP interface gi1/1 both limit packets xxxx match ipv4 any any
!
monitor capture TEST-DUMP start
monitor capture TEST-DUMP stop
!
export also up to us, in flash on router or directly to tftp server of ftp server
monitor capture TEST-DUMP export flash:TEST-DUMP.pcap
!
don't forget delete ant the end
no monitor capture TEST-DUMP

[Joseph W. Doherty]

---

@Mlex1 wrote:

i found another option without settings SPAN 

steps 
in new equipment, here it's up to us any interface ACL, etc
monitor capture TEST-DUMP interface gi1/1 both limit packets xxxx match ipv4 any any
!
monitor capture TEST-DUMP start
monitor capture TEST-DUMP stop
!
export also up to us, in flash on router or directly to tftp server of ftp server
monitor capture TEST-DUMP export flash:TEST-DUMP.pcap
!
don't forget delete ant the end
no monitor capture TEST-DUMP

---

Ah, isn't "monitor" a SPAN configuration command?  For example, as shown in: https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html

So, unclear how you're not using a SPAN setting options.  Unless it's the capability to "export" to the device's own flash.