IOS packet capture not working

[Matt Roberts]

I did these steps on a 2960x but get no captured packets

monitor capture buffer MYBUFFER size 10000 max-size 15500 circular

monitor capture point ip cef CAP gi1/0/3 both

monitor capture point associate CAP MYBUFFER

monitor capture point start CAP

I get no results

Capture buffer MYBUFFER (circular buffer)
Buffer Size : 10240000 bytes, Max Element Size : 1550 bytes, Packets : 0
Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0
Associated Capture Points:
Name : CAP, Status : Active
Configuration:
monitor capture buffer MYBUFFER size 10000 max-size 1550 circular
monitor capture point associate CAP MYBUFFER

What am I missing?

[roor]

Hi Matt,

2960X does not support wireshark capture. What version of sofware are you running on your switch. On the 2960X that I have I do not even see those commands.

2960X(config)#monitor ?
  event-trace  Tracing of system events
  session      Configure a SPAN session

Thanks,

Roopa

[MATTHIAS SCHAERER]

Apparently the commands are there and the feature works in a way. If you use "ip process-switched" then you see all the traffic from and to the switch itself. But I have not yet found a way to capture traffic that goes through the switch. 

I have not found any clear indication in the documentation that specifies if the feature should be available or not. In any case as it is a "low end" switch I could imagine that it is not implemented for the purpose you want to use it.

If anybody has more precise information this would be helpful.