07-22-2016 06:24 AM - edited 03-08-2019 06:44 AM
Can't seem to capture packets. What am I doing wrong? show parameters at the bottom lists zero packets captured...
Switch: WS-C2960X-48FPD-L Version 15.2(3r)E1, RELEASE SOFTWARE (fc1)
Commands:
CFC-ST2#config t
CFC-ST2(config)#access-list 144 permit icmp any any echo
CFC-ST2(config)#access-list 144 permit icmp any any echo-reply
CFC-ST2(config)#end
CFC-ST2#monitor capture buffer buffer-icmp size 8192
CFC-ST2#monitor capture buffer buffer-icmp filter access-list 144
CFC-ST2#monitor capture point ip cef icmptrace all both
CFC-ST2#monitor capture point associate icmptrace buffer-icmp
CFC-ST2#monitor capture point start icmptrace
CFC-ST2#ping 10.30.10.95
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.30.10.95, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
CFC-ST2#show access-list 144
Extended IP access list 144
10 permit icmp any any echo
20 permit icmp any any echo-reply
CFC-ST2#show monitor capture buffer all parameters
Capture buffer buffer-icmp (linear buffer)
Buffer Size : 8388608 bytes, Max Element Size : 68 bytes, Packets : 0
Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0
Associated Capture Points:
Name : icmptrace, Status : Active
Configuration:
monitor capture buffer buffer-icmp size 8192
monitor capture point associate icmptrace buffer-icmp
monitor capture buffer buffer-icmp filter access-list 144
Solved! Go to Solution.
07-22-2016 08:42 AM
I haven't looked closely at EPC on the switching platforms, but you're capturing CEF switched packets (transit)
monitor capture point ip cef icmptrace all both
When you're sending or receiving ICMP packets from the switch CLI, those are process switched. Try changing your capture point to "process-switched" or "from-us" instead of CEF.
07-22-2016 08:42 AM
I haven't looked closely at EPC on the switching platforms, but you're capturing CEF switched packets (transit)
monitor capture point ip cef icmptrace all both
When you're sending or receiving ICMP packets from the switch CLI, those are process switched. Try changing your capture point to "process-switched" or "from-us" instead of CEF.
07-27-2016 06:49 AM
Hi,
The embedded packet capture (EPC) does not appear to capture packets because EPC is not supported on the 2960 platform even though EPC commands are accepted.
This is considered a bug, since commands are accepted but they do not work because of platform limitations. This issue affects other platforms as well like the 3750 and 3560.
This is the link with the information about the bug is the following:
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCui33787
If you want to take a capture the option is to do a SPAN session.
Regards,
Jose
07-27-2016 07:02 AM
Thank you! I changed that option and can now capture packets.
Wonderful!
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide