Cat 9000 embedded wireshark and required license

[Johannes Luther]

Hi board,

numerous document state, that wireshark requires the dna-advantage (and network-advantage) license:

https://www.cisco.com/c/m/en_us/products/software/dna-subscription-switching/en-sw-sub-matrix-switching.html?OID=otren019471

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9300/software/release/16-12/configuration_guide/nmgmt/b_1612_nmgmt_9300_cg/configuring_packet_capture.html

However, I can use it without any restriction (at least I didn't find any) on a Cat 9300 with network and dna-essentials.

For example:

monitor capture CAPTURE_SESSION_1 control-plane both
monitor capture CAPTURE_SESSION_1 buffer circular size 5
monitor capture CAPTURE_SESSION_1 match ipv4 any any
monitor capture CAPTURE_SESSION_1 limit duration 10
monitor capture CAPTURE_SESSION_1 start display

==> Works like a charm (I know ... you shouldn't use "display")

So my question is:

• Is the documentation incorrect?
• Is the switch working incorrectly (currently IOS-XE 16.12.2)
• I did something wrong or understood the documents incorrectly

Thanks and best regards

Johannes

[ambtaylo]

The tool works differently depending on license level. What you see is a limited version of the capture tool called EPC (Embedded Packet Capture. Try with higher license and the syntax will change as well as the capabilities, and is a variant called Embedded Wireshark 

[bradley.riley]

How do you access and use it without the ability to save as a .pcap? 

I am trying to find if there is burst traffic that is causing packets dropped from output queue, and if so, what is the traffic.