How to log packets(frames) on a switch

[JustTakeTheFirstStep]

I want to know if the packets go through the switch.

Is it possible to log frames with origin and destination on the switch?

I'm not asking, check with wireshark.

[MHM Cisco World]

what is SW platform ?
if your SW platform support capture you can use it to capture the traffic enter the SW. 

[JustTakeTheFirstStep]

2960 3850 9200 9300
Viewing with wireshark using SPAN is not what I want.

[MHM Cisco World]

Session Presentation (ciscolive.com)

check this ciscolive

[balaji.bandi]

There are different ways to do this, depending on requirements.

1. you can SPAN the session to mirror the traffic

2. if you have the latest model of switch, you can packet capture inside

3. same way if you have the latest model switch IOS code support, you can use NetFlow

[JustTakeTheFirstStep]

Viewing with wireshark using SPAN is not what I want.

[balaji.bandi]

how about other tools which i suggested, what have you tried?

[mlund]

If the switch supports QoS, you can define class-map that identify your flow, then a policy-map that have your class-map. Then put your policy-map into an interface. Then you can look up the counters in the policy-map with "show service-policy interface <nr>"

[Georg Pauwen]

What do you want to accomplish exactly, why don't you want to use SPAN ? The 9300 supports circular and linear packet capture, see the link below. It is still recommended to export a .pcap file (to e,g, wireshark). Why don't you want to use Wireshark ?

https://www.engineerkhan.com/networking/packet-capture-on-cisco-9300-switches/

[JustTakeTheFirstStep]

What I want is something like this.

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-embedded-packet-capture/116045-productconfig-epc-00.html

[MHM Cisco World]

are you ever check the link I share ?

[balaji.bandi]

Like this using ASA ? or on what device you looking to do ?

ASA already doing that task, what you expecting here ?

[JustTakeTheFirstStep]

Like the ASA, I want similar functionality on a 2960 or 9200 switch.

[johnlloyd_13 · Accepted solution]

hi,

you can use debug ip packet privilege command.

you can also use an ACL to be more granular/specific in your output and also not to overwhelm CPU.