cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2623
Views
6
Helpful
2
Replies

cisco 3850 wireshark capture not working?

brian.kennedy
Level 1
Level 1

creating a simple capture on a port on a cisco 3850;

monitor capture test interface g1/0/1 both
monitor capture test match ipv4 any any
monitor capture test file location flash:test.pcap buffer-size 10
monitor capture test limit packets 1000

monitor capture test start   (runs and ends immediately).  Log shows capture starting and ending, but no file in flash:

Works on some (at least one) device, doesn't on a couple others I've tried.  Same device, running same code (3.6.4).  

Anyone seen this?

1 Accepted Solution

Accepted Solutions

Mark Malone
VIP Alumni
VIP Alumni

Yes lot of complaints epc on ios-xe works on certain versions for some not others , doesn't work on lan base sometimes works on ip services ,its a bit hit and miss

ran into myself a few times on my 36s and 38s pretty annoying , I just gave up trying to get it to work too much time spent and went back to standard span that worked fine

this give a guide of how its done but you can see the comments below

https://supportforums.cisco.com/document/12013221/using-3850-embedded-wireshark-wired

View solution in original post

2 Replies 2

Mark Malone
VIP Alumni
VIP Alumni

Yes lot of complaints epc on ios-xe works on certain versions for some not others , doesn't work on lan base sometimes works on ip services ,its a bit hit and miss

ran into myself a few times on my 36s and 38s pretty annoying , I just gave up trying to get it to work too much time spent and went back to standard span that worked fine

this give a guide of how its done but you can see the comments below

https://supportforums.cisco.com/document/12013221/using-3850-embedded-wireshark-wired

jonathan_flores
Level 1
Level 1

FYI per the comments in the link by previous SOLVED comment. The command that worked for me was setting the file destination to flash-1: (active switch of stack) 

Version:  03.06.03E

Command: 

monitor capture mycap file location flash-1:mycap.pcap buffer-size 10

Review Cisco Networking for a $25 gift card