Best way to capture packets on the switch

[banoosh]

Dears,

what is the best way(commands) to capture packets from the interface and extract it to wireshark

[Leo Laohoo]

What is the model of the switch?

[banoosh]

c9300l

[MHM Cisco World]

[banoosh]

any support? 

@Leo Laohoo 

[Torbjørn]

If you have physical access to the switch you should be able to configure a SPAN port.

Device> enable
Device# configure terminal
! The interface you wish to capture from
Device(config)# monitor session 1 source interface gigabitethernet1/0/1 
! Where you want the frames sent to
Device(config)# monitor session 1 destination interface gigabitethernet1/0/2 encapsulation replicate 
Device(config)# end

You can read more about SPANs here: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/16-5/configuration_guide/nmgmt/b_165_nmgmt_9300_cg/b_165_nmgmt_9300_cg_chapter_0101.html

If you don't have physical access to the switch you will probably want to use embedded packet capture. You can do this using the commands below. Once you have made the packet capture you can download the file to your computer using SCP.

Device# monitor capture mycap interface GigabitEthernet1/0/3 in
Device# monitor capture mycap match ipv4 any any
Device# monitor capture mycap limit duration 60 packets 50
Device# monitor capture mycap file location flash:mycap.pcap

You can read more about this here: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/16-6/configuration_guide/nmgmt/b_166_nmgmt_9300_cg/b_166_nmgmt_9300_cg_chapter_0110.html

[Leo Laohoo]

1. Enter the management IP address of the switch into a web browser. 
2. Go to Troubleshooting. 
3. Choose Packet Capture. 
4. Click Add
5. Select the interface and click "Apply". 
6. Hit "Start".