EPC on IOS-XE - no packets in buffer

[wcoppelov]

I have configure EPC on an ISR4331 (IOS-XE 16.09.05) router interface but the buffer contains no packets after starting the capture.

I'm specifically interested in UDP traffic on Etherswitch interface (Gig0/1/0) - the module is a NIM-ES2-4

There is definitely traffic through the interface.

ip access-list extended PACKET_CAPTURE
permit udp any any

!

Router# monitor capture FOCAP access-list PACKET_CAPTURE
Router# monitor capture FOCAP interface GigabitEthernet 0/1/0 both 
Router# monitor capture FOCAP buffer circular size 2
!
Router# monitor capture FOCAP start
!

Even though there is traffic on the interface there is nothing in the capture buffer

Router# show monitor capture FOCAP buffer brief
Router# show monitor capture FOCAP buffer dump

The equivalent configuration under IOS works fine (HWIC-4ESW Etherswitch)

Debug output is attached.

The debug highlights the following:

044773: Aug 27 09:55:25.590: EPC CP: Checking for file options based on wireshark support
044774: Aug 27 09:55:25.590: EPC CP: Wireshark not supported
044775: Aug 27 09:55:25.590: EPC CP: Wireshark and file options are not supported

Thanks

[pieterh]

When I scan your log i see both BOCAP and FOCAP

 are these two different tests or a typo?

[wcoppelov]

EPC on the NIM-ES2-4 is not supported (comes from HW limitations).
We can use SPAN feature to capture all packets on the etherswitch module.

[Georg Pauwen]

Hello,

use the syntax below:

ip access-list extended PACKET_CAPTURE
permit udp any any
!
Router# monitor capture buffer FOCAP size 2048 max-size 4000 circular
Router# monitor capture FOCAP access-list PACKET_CAPTURE
Router# monitor capture point ip cef CAP_GI0/1/0 GigabitEthernet 0/1/0 both
Router# monitor capture point associate CAP_GI0/1/0 FOCAP

[wcoppelov]

Hi Georg,

EPC is not supported on the NIM-ES2-4 module so I shall use SPAN and capture packet externally.

Thanks.