How can I fetch packet capture from aws deployed router

[mabinvattothu]

How can I fetch packet capture from aws deployed router and fetch to my pc as a pcap

[balaji.bandi · Accepted solution]

May be TFTP / SCP ?

[Kanan Huseynli · Accepted solution]

Hi,

use EPC (embedded packet capture) with "monitor capture" commands and export to .pcap in local disk (bootflash).

Most probably you have access to device via SSH, so SCP will work for you. If for some reason you manage only locally, you can create guestshell inside router and export .pcap capture file to S3 (your EC2 machine i.e router will need IAM role to access S3).

Above is described in this doc:

https://www.cisco.com/c/en/us/td/docs/routers/csr1000/software/aws/b_csraws/enabling_the_guest_shell.html

Basically, guest linux shell is created which has its own IP and router is next-hop for that "linux box" (virtually in the background which is 192.168.x.x in the doc) then this virtual interface is NAT-ed to outside interface over which S3 is reachable (that outside interface should be in "public subnet" which means you have public IP for that interface via IGW or in "private subnet" but Nat GW is enabled).

If you also don't have internet access from router (router is in private subnet without NAT), then you may deploy S3 gateway endpoint (free) or interface endpoint (costly).