Showing results for 
Search instead for 
Did you mean: 

Onboard Packet Capture SDA


Hi SDA-Experts, 


shortly to the environement: 


we have an SDA Fabric in our Location. 


We use the Catalyst C9300-48P as Access Switch. 

Our actual version is the 17.3.4 (which was the recommended at this time) 


Now we recently had a case on our end where we wanted to capture multicast traffic for one of the attached devices. 

Since it is a quite remote location we wanted to use the onboard capture of the C9300. 

So we added the Trace like this: 

monitor capture [CapName] file ring 3 size 100 location flash:[CAPNAME].pcap interface [,...] both match any


But from the capture itself I only see incoming traffic. So from the device to the switch.  Everything which is 

VXLAN encapsulated to the device is not visible here. We did a workaround to capture the Uplink and decoded VXLAN in the capture. But for switches with high traffic beside the one we want to capture this is not feasible since we get a big load of data that we don't need... 


Anybody has some tip how to get all the traffic? Or is the only way to do a span session? 



1 Reply 1

Flavio Miranda


 The behavior you are seing seems to be expected. As you are using "Embedded Packet Capture", Cisco informs that:

"EPC captures multicast packets only on ingress and does not capture the replicated packets on egress."


What you can try is to use "Wireshark" mode on the switch. Ultimately, you can try to run Wireshark on the endpoint, if possible.


You can refer to this guide for more information: 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers