Embedded Packet Capture: CEF or Process switched?

[David Kleberson]

I have a question about EPC.

When I configure it there is an option 

LABRTR#monitor capture point ip ?
  cef               IPv4 CEF
  process-switched  Process switched packets

LABRTR#monitor capture point ip

When I choose cef router gives me different an option to pick the interface, but when I choose process-switched it gives me a few options.

I'm just wondering which is better to choose when you are capturing?

Thanks!

[Terence Payet · Accepted solution]

Hi,

For normal data plane packets, use CEF path. For packets that are destined to the router itself, use the process-switched path.

HTH.

Please rate helpful post.

Regards,

Steve

[Mohammed al Baqari · Accepted solution]

Hi,

It depends on what traffic do you want to capture.

CEF switching is used when the router is acting as transit device to forward packets. Therefore, you can select interfaces (since it is transit device).

Process switching is used when the traffic is originated or hitting the router itself. In this case you capture from the backplane which is the source or the traffic and the interface will be irrelevant.

[Smriti Agarwal]

Hello,

I am not able to capture any packets in the cef mode for any direction i.e. in, out, both. I am able to capture in process-switched mode though. The network monitoring tool at my enterprise shows traffic through this interface. Following is my configuration:

 monitor capture point ip cef point11 TenGigabitEthernet 0/0/13 out

920i-2#sh monitor capture buffer buf4 para
Capture buffer buf4 (linear buffer)
Buffer Size : 104857600 bytes, Max Element Size : 256 bytes, Packets : 0
Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0
Associated Capture Points:
Name : point11, Status : Active
Configuration:
monitor capture buffer buf4 size 102400 max-size 256 linear
monitor capture point associate point11 buf4
monitor capture buffer buf4 filter access-list buf2-filter

Please help!