How to View Transmit/Receive Packets for a Particular IP on a Switch

[John Robinson IV]

Hello! I am looking for a command that would allow me to view traffic that goes to or coming from a specific IP on a switch.

Scenario: Ping does not work (it is blocked), but I need to see if traffic to a particular IP is working. Is there a show and/or debug command that would show me the traffic to/from a particular IP on a Catalyst 9300 switch?

OR

Is there way to see what traffic is on a particular Switchport (outside of doing a wireshark capture on that port). In other words, is there a way to take a quick glance? Thank you

[Joseph W. Doherty]

Some later Cisco switches support embedded packet capture.

https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-embedded-packet-capture/116045-productconfig-epc-00.html

[John Robinson IV]

I'll take a look into this feature. The link doesn't work but I will research this. Is there a way to tell what devices this works on specifically?

[Joseph W. Doherty]

Try my referenced link now (somehow, I missed the last character when I copied and pasted it).

[John Robinson IV]

Thank you! 

[MHM Cisco World]

I am out of home now, but I have fast answer 

Go and make ping with 100 repeat 

Do

Show ip interface 

Chech input packet count

This first and easy counter you can check.

[John Robinson IV]

Thank you! In this case I'd like to see the specifics of the packets not just how many packets have transpired. I'd like to be able to see what the packet source and destination IPs and ports are, if possible.

[MHM Cisco World]

https://www.ciscolive.com/c/dam/r/ciscolive/us/docs/2019/pdf/BRKARC-3190.pdf

use capture BUT friend disable capture after finish it effect the CPU.

[John Robinson IV]

Thanks so much I'll be trying this out soon!

[Seb Rupik]

Hi there,

You could create a simple ACL (permit tcp/udp any any log) and apply it to the interface. The log statement will ensure all flows are recorded in your logs. You may need to adjust your log level to ensure they appear.

cheers,

Seb.

[John Robinson IV]

This is helpful! Thank you!