cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
3255
Views
10
Helpful
6
Replies

3850 embedded packet capture export not working

suelange
Level 1
Level 1

according to this document: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/epc/command/epc-cr-book/epc-cr-m1.html#wp3379948068

 

I should be able to issue this command:

monitor capture CAP export tftp://10.4.72.12/CAP.pcap

and my capture buffer should get placed on a server where I can examine it with wire shark.  Except that my 3850 tells me it is an invalid input at the point where "tftp" begins.   running cat3k_caa-universalk9.16.03.05b.SPA.   this should work I would think...  I saw a similar post for someone with 3850 who can't ftp or tftp...did not see a solution for them.   

 

I have packets in the capture, I can show them both brief and detailed.

 

Is there a way to get the capture off the 3850 and into wireshark?

1 Accepted Solution

Accepted Solutions

Ok, so FTP and TFTP are not options.

The options are:

crashinfo: Location of the file
flash: Location of the file
usbflash0: Location of the file

HTH

View solution in original post

6 Replies 6

Reza Sharifi
Hall of Fame
Hall of Fame

Is ftp an option at the end of the command? I don't see it in earlier versions of IOS-XE

Can you try: 

monitor capture test export ?

and post the output?

HTH

when I used the question mark to prompt for options, it told me I should supply it with file|location.  It does not say FTP or TFTP key words either one.

Ok, so FTP and TFTP are not options.

The options are:

crashinfo: Location of the file
flash: Location of the file
usbflash0: Location of the file

HTH

Thank you Reza.  So anyone out there from Cisco willing to explain why this is?   Why do some systems have the convenience of being able to download these files so they can be worked with a real packet sniffing tool and why some systems you have to jump through a dozen hoops...assuming even that will get you where you want to be?   Crazy.  AND, the document I sited at the start of this post was *supposedly* related to 3850 command structure, and it clearly states ftp and tftp can be used.  But clearly they cannot.  

 

Reza again my thanks to you.  Cisco...boo hiss!

Working with Cisco equipment and software for years, I can tell you that there are a lot of inconsistencies between documentation and what the OS is actually capable of doing. Also, Cisco has never been good at providing this type of features in their platforms and OSs. 

HTH  

fsebera
Level 4
Level 4

Hi Suelange,

 

I was looking to perform the same action BUT saving to flash, then copy to TFTP server, then deleting the pcap file from flash is a lot of extra work. 1 cli statement is much more efficient.

 

Happy to say using:

IOS-XE

Gibraltar 16.12.02

mon cap xx export tftp://192.168.1.55/ce-g2_20-ICMP-AF12-1201-1220.pcap

 

Send directly to TFTP server, load into Wireshark and all is good!!

Thanks

Frank

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: