Embedded Packet Capture on 3650 with LANBASE

[Zoran BKV]

Hiya doin' folks,

I'm currently having some trouble with EPC running on IOS XE  WS-C3650-48PD 16.6.5.

I can configure it just fine and the output of "show monitor capture mycap" and / or "show monitor capture mycap parameter" lokks good, just as it should be, but....

the buffer is empty. There are no packets captured in the buffer. I can export the file to flash or ftp server and open it in wireshark but it's empty. The "show monitor capture mycap" also show 0 packets captured.

Here's what I do:

Switch# monitor capture mycap interface GigabitEthernet1/0/3 both
Switch# monitor capture mycap match ipv4 any any
Switch# monitor capture mycap buffer circular size 30
Switch# monitor capture mycap start

Switch# monitor capture mycap stop

Switch# show monitor capture mycap brief

Switch# show monitor capture mycap dump

I did the same procedure on an IPBASE switch and it work, besides that I didn't store it in buffer but directly had it copied into flash. Of course, the EPC only supports buffer option with possibility to export it.

Anyone? I'd be really thankful.

[Mark Malone]

Hi
Only IP base supports export with wireshark LAN base does not , its in the docs if you check online ,
38s also have it only as ip base and services to use EPC , 36s state it only support wireshark output in IP BASE

Restrictions

License: Requires IPBASE or IPSERVICES.

PDF Link 36s
https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=2&cad=rja&uact=8&ved=2ahUKEwiekrjM_L_hAhWBsnEKHZQxAXkQFjABegQICxAE&url=https%3A%2F%2Fwww.cisco.com%2Fc%2Fen%2Fus%2Ftd%2Fdocs%2Fswitches%2Flan%2Fcatalyst3850%2Fsoftware%2Frelease%2F16-1%2Fc...

[Zoran BKV]

Thank you for your reply. I'm aware of the document, but the issue is that the buffer is empty. So I'm unable to check traffic directly on the switch.

But the export command is there, in order to export buffer content into pcap file and it works as well:

monitor capture TESTPCAP export ftp://myserver

Nevertheless,

I'm unable to populate buffer with traffic, so I'm unsure why isn't there any traffic coming into buffer?

[Mark Malone · Accepted solution]

i just tested this on denali 16.3.7 3650 same issues lanbase exact same config your using , works fine on ip base denali 16.3.7 , say your hitting some license limitation as its not a config issue

switches Model Number : WS-C3650-48PS
* 1 52 WS-C3650-48PS 16.3.7

working

############################
sh license right-to-use | i base
1 ipbase permanent N/A Lifetime
License Level on Reboot: ipbase


# monitor capture mycap interface GigabitEthernet1/0/48 both
#monitor capture mycap match ipv4 any any
# monitor capture mycap buffer circular size 30
#monitor capture mycap start
Started capture point : mycap
monitor capture mycap stop
Capture statistics collected at software:
Capture duration - 10 seconds
Packets received - 113
Packets dropped - 0
Packets oversized - 0

Bytes dropped in asic - 0

Capture buffer will exists till exported or cleared

Stopped capture point : mycap


#######show monitor capture mycap

Status Information for Capture mycap
Target Type:
Interface: GigabitEthernet1/0/48, Direction: BOTH
Status : Inactive
Filter Details:
IPv4
Source IP: any
Destination IP: any
Protocol: any
Buffer Details:
Buffer Type: CIRCULAR
Buffer Size (in MB): 30
File Details:
File not associated
Limit Details:
Number of Packets to capture: 0 (no limit)
Packet Capture duration: 0 (no limit)
Packet Size to capture: 0 (no limit)
Maximum number of packets to capture per second: 1000
Packet sampling rate: 0 (no sampling)
#######

NOT Working

#######################

############# monitor capture mycap interface GigabitEthernet1/0/48 both
#############monitor capture mycap match ipv4 any any
#############monitor capture mycap buffer circular size 30
#############monitor capture mycap start
Started capture point : mycap
#############monitor capture mycap stop
Bytes dropped in asic - 0

Stopped capture point : mycap
#############show monitor capture mycap brief
^
% Invalid input detected at '^' marker.

#############show monitor capture mycap dump
^
% Invalid input detected at '^' marker.

#############show monitor capture mycap

Status Information for Capture mycap
Target Type:
Interface: GigabitEthernet1/0/48, Direction: BOTH
Status : Inactive
Filter Details:
IPv4
Source IP: any
Destination IP: any
Protocol: any
Buffer Details:
Buffer Type: CIRCULAR
Buffer Size (in MB): 30
Limit Details:
Number of Packets to capture: 0 (no limit)
Packet Capture duration: 0 (no limit)
Packet Size to capture: 0 (no limit)
Maximum number of packets to capture per second: 1000
Packet sampling rate: 0 (no sampling)


#sh license right-to-use | i base
1 lanbase permanent N/A Lifetime

[Zoran BKV]

Thank you Mark for your swift replies.

Than I'll just leave it as it is, as I already invested too much time in troubleshooting.

Will try on the next reelases again when we update the switches.

Gonna mark your answer as solution in case anyone else has troubles strugling with this one.

Cheers

[Mark Malone]

Thanks Zoran

[Modestas]

Hi Zoran

Were you able to resolve embedded capture issue on devices running 16.6.5?

I have noticed that capture buffers is always empty on each of tested numerous switches running 16.6.5. However, capture is working properly other switches running 16.3.7 or 16.9.4.

I don't share Mark's view on the license level impact. I believe, Lanbase level seems to be fine for embedded capture.

Best regards

Modestas

[Zoran BKV]

Hi Modestas,

sorry for the late reply. No, I wasn't able to solve this so I just let it as it is. no packet capture on devices running lan base.

Cheers