Using embedded packet capture on an ISR 4000
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
09-03-2021 12:34 AM - edited 09-03-2021 12:50 AM
I am trying to capture traffic on an ISR4000. I have the capture setup as:
monitor capture mycap access-list SUBNETS
monitor capture mycap interface gi0/0/3.200 both
monitor capture mycap limit duration 60
monitor capture mycap buffer size 40
monitor capture mycap start
monitor capture mycap export flash:my.cap
When i look at the size of the capture file my.cap it ends up very small.
When i analyse the file in wireshark, i can see that the right traffic is being recorded.
However its only a few seconds worth rather than 60 seconds.
Why might the capture not be running for the specified length? My flash: partition has plenty of space
EDIT: I see the issue. I have to let the capture complete before i run the 'export' command!
- Labels:
-
ISR 4000 Series
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
09-03-2021 06:52 AM
Try remove duaration and buffer size, make sure you offload from the router. to any other outside source.
may be due to time, increase and see if you get more data.
check below syntax :
