12-28-2023 04:01 PM - edited 12-28-2023 04:12 PM
Hi all,
I have Catalyst 4500 L3 Switch and I am trying to capture packets with EPC on interface TenGigabitEthernet1/3 but I don't see any packets coming. This is the input output rate:
5 minute input rate 1394322000 bits/sec, 1530297 packets/sec
5 minute output rate 1078396000 bits/sec, 792587 packets/sec
This is part of running config:
vlan 10
name 88.88.88.0/24
!
interface FastEthernet1
vrf forwarding mgmtVrf
ip address 1.2.3.4 255.255.255.0
speed auto
duplex auto
!
interface TenGigabitEthernet1/1
description UPLINK/UNMANAGED CORE Te0/2
no switchport
ip address 1.1.2.2 255.255.255.0
no cdp enable
!
!
interface TenGigabitEthernet1/3
description TO: DOWNLINK-88.88.88.0
switchport trunk allowed vlan 10
switchport mode trunk
switchport nonegotiate
Does anybody knows what might be the problem because when i try to capture packets from TenGigabitEthernet1/1 everything is ok. I am new to all this so if you need any more info on config let me know.
Solved! Go to Solution.
12-28-2023 04:47 PM
Hello,
Your config shows that interface TenGigabitEthernet1/1 is a L3 port while interface TenGigabitEthernet1/3 is a L2 port. The EPC might only be good for L3 interfaces/traffic (packets). For L2 captures you may need to use SPAN/RSPAN/ERSPAN and send to a server to check frames coming across the link. It wouldn't be as granular as EPC though.
-David
12-28-2023 04:14 PM
can I see the capture command you use
12-28-2023 04:19 PM
Sure,
Buffer Size : 2097152 bytes, Max Element Size : 1518 bytes, Packets : 0
Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0
Associated Capture Points:
Name : POINTT, Status : Active
Configuration:
monitor capture buffer BUFF size 2048 max-size 1518 linear
monitor capture point associate POINTT BUFF
Status Information for Capture Point POINTT
IPv4 CEF
Switch Path: IPv4 CEF , Capture Buffer: BUFF
Status : Active
Configuration:
monitor capture point ip cef POINTT TenGigabitEthernet1/3 both
12-28-2023 04:38 PM
follow this guide, use second approach <monitor capture point ip cef....>
https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-embedded-packet-capture/116045-productconfig-epc-00.html
MHM
12-28-2023 04:47 PM
Hello,
Your config shows that interface TenGigabitEthernet1/1 is a L3 port while interface TenGigabitEthernet1/3 is a L2 port. The EPC might only be good for L3 interfaces/traffic (packets). For L2 captures you may need to use SPAN/RSPAN/ERSPAN and send to a server to check frames coming across the link. It wouldn't be as granular as EPC though.
-David
12-29-2023 06:21 PM
You are right, I didn't know that EPC is only good for L3 interfaces. Thanks for help.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide