Can't see any packets on interface

[dragojlo]

Hi all,

I have Catalyst 4500 L3 Switch and I am trying to capture packets with EPC on interface TenGigabitEthernet1/3 but I don't see any packets coming. This is the input output rate:

5 minute input rate 1394322000 bits/sec, 1530297 packets/sec
5 minute output rate 1078396000 bits/sec, 792587 packets/sec

This is part of running config:

vlan 10
name 88.88.88.0/24
!
interface FastEthernet1
vrf forwarding mgmtVrf
ip address 1.2.3.4 255.255.255.0
speed auto
duplex auto
!
interface TenGigabitEthernet1/1
description UPLINK/UNMANAGED CORE Te0/2
no switchport
ip address 1.1.2.2 255.255.255.0
no cdp enable
!
!
interface TenGigabitEthernet1/3
description TO: DOWNLINK-88.88.88.0
switchport trunk allowed vlan 10
switchport mode trunk
switchport nonegotiate

Does anybody knows what might be the problem because when i try to capture packets from TenGigabitEthernet1/1 everything is ok. I am new to all this so if you need any more info on config let me know.

[MHM Cisco World]

can I see the capture command you use

[dragojlo]

Sure,

Buffer Size : 2097152 bytes, Max Element Size : 1518 bytes, Packets : 0
Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0
Associated Capture Points:
Name : POINTT, Status : Active
Configuration:
monitor capture buffer BUFF size 2048 max-size 1518 linear
monitor capture point associate POINTT BUFF

Status Information for Capture Point POINTT
IPv4 CEF
Switch Path: IPv4 CEF , Capture Buffer: BUFF
Status : Active

Configuration:
monitor capture point ip cef POINTT TenGigabitEthernet1/3 both

[MHM Cisco World]

follow this guide, use second approach <monitor capture point ip cef....>
https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-embedded-packet-capture/116045-productconfig-epc-00.html

MHM

[David Ruess · Accepted solution]

Hello,

Your config shows that interface TenGigabitEthernet1/1 is a L3 port while interface TenGigabitEthernet1/3 is a L2 port. The EPC might only be good for L3 interfaces/traffic (packets). For L2 captures you may need to use SPAN/RSPAN/ERSPAN and send to a server to check frames coming across the link. It wouldn't be as granular as EPC though.

-David

[dragojlo]

You are right, I didn't know that EPC is only good for L3 interfaces. Thanks for help.