collecting packet capture from a Cisco routed interface

[johneyboy]

We are trying to setup a monitor session for a routed interface on a Cisco 4431 ISR router.  From all the search result, it seems I can only perform packet capture monitor session on a switch module for a layer 2 interfaces.  Is there any way we can perform similar monitor session for L3 interfaces?  Appreciate for all the constructive feedback in advances.

[M02@rt37 · Accepted solution]

Hello @johneyboy 

You could use ERSPAN on your ISR 4431 to perform remote monitoring of L3 traffic. ERSPAN allows you to capture and forward traffic from a source interface to a destination interface for analysis on a remote device.

[David Ruess]

Hello,

You should be able to configure monitoring on a L3 interface using Embedded Packet Capture with the below commands:

ip access-list extended PACKET_FILTER permit ip host 192.168.12.1 host 192.168.23.3

monitor capture TEST buffer circular limit packets 1000 interface g0/0/0 both

monitor capture buffer TEST filter access-list PACKET_FILTER start

This is just an example. You can match and filter on lots of things. You configure this in Privilege EXEC mode. Make sure to use the keyword start when you want to start it. It will stop when it reaches your configured limit or you stop it.

You can verify with the command: sh monitor capture TEST buffer {brief}

Hope this helps.

-David

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-embedded-packet-capture/116045-productconfig-epc-00.html

this guide help you to capture traffic in interface 
MHM

[johneyboy]

Thank you for everyone's inputs.  Just a little more context about my setup.  The company wants to setup a permanent monitoring tool inside the data center for our edge router which happens to be the ISR 4431.  We have a dedicated server behind the router for this purpose.  I think ERSPAN is the right approach in our case.  

[MHM Cisco World]

Yes you are correct
after I reply I deep thinking and it true ERSPAN is for real time traffic monitor what I suggest is only for troubleshooting and for short period.
Glad your issue solve and your answer help you here 
have a nice weekend 
MHM