3850 packet cature

[Mary]

3850 switch can't use embeded packet capture, is there any external tool can capture packet from 3850

another issue, we have a router, but i can't change configure, only display, I capture the packet, but I can't export to my tftp. is there any way? or I can display the packets inside router login instaed of export to wireshark

[InayathUlla Sharieff]

3850 switch can't use embeded packet capture, is there any external tool can capture packet from 3850

Answer:- you can use embedded packet capture on the box and view that via wireshark. External tool then you need to connect one of the PC and do the span capture for athe traffic coming in and going out.

Second issue:- Regarding router:- Not sure which router it is then exporting problem you need to make sure that your tftp is reachable from that router.

[Mary]

Answer:- you can use embedded packet capture on the box and view that via wireshark

no, for 3850, for IOS-XE, under monitor capture command, there is no associate command, thus not able to

[Carlos Villagran]

You can use the embebed wireshark on 3850 and save it in a buffer to see the capture right in the switch or you can configure a SPAN in the switch and see the capture in your PC via Wireshark.

Please refer to the following link for the SPAN configuration:

http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html

If you are interested in the capture and display inside the switch, let me know.

Hope it helps,best regards!

JC