Capture feature on switch

[cisco8887]

Hi All,

I have a question on monitor capture feature of switch which can capture the packets on teh fly and then you can view it in hex dump or export to pcap format

The two options I see are capture process switching and capture cef .

with process switching you can't define what interface to capture however with cef you can.

I have enabled cef capture on interface x and can not see the capture buffer capturing any packets yet I can see the interface counters increasing.

How can this be ?

Is it some layer 2 that cef can't catch ?

it is on a 2960 switch .

Many thanks

[rvarelac]

Hi, 

This type of capture is called Embed packet capture (EPC) and  is supported from IOS code 12.4 and up.  Howeve this feature can be only used with Cisco routers,  in order to capture the data in a switch you need to configure a SPAN session.

Hope it helps

-Randy-

[cisco8887]

Thanks for this

it does actually work on switch .i tried it and it captured process switched data where you can not define an interface

you can define an interface with cef switching but nothing gets captured hence my question