Packet Capture Config Question

[dspender]

Can't seem to capture packets. What am I doing wrong? show parameters at the bottom lists zero packets captured...

Switch: WS-C2960X-48FPD-L  Version 15.2(3r)E1, RELEASE SOFTWARE (fc1)

Commands:

CFC-ST2#config t
CFC-ST2(config)#access-list 144 permit icmp any any echo
CFC-ST2(config)#access-list 144 permit icmp any any echo-reply
CFC-ST2(config)#end

CFC-ST2#monitor capture buffer buffer-icmp size 8192

CFC-ST2#monitor capture buffer buffer-icmp filter access-list 144

CFC-ST2#monitor capture point ip cef icmptrace all both

CFC-ST2#monitor capture point associate icmptrace buffer-icmp

CFC-ST2#monitor capture point start icmptrace

CFC-ST2#ping 10.30.10.95
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.30.10.95, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms

CFC-ST2#show access-list 144
Extended IP access list 144
10 permit icmp any any echo
20 permit icmp any any echo-reply

CFC-ST2#show monitor capture buffer all parameters
Capture buffer buffer-icmp (linear buffer)
Buffer Size : 8388608 bytes, Max Element Size : 68 bytes, Packets : 0
Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0
Associated Capture Points:
Name : icmptrace, Status : Active
Configuration:
monitor capture buffer buffer-icmp size 8192
monitor capture point associate icmptrace buffer-icmp
monitor capture buffer buffer-icmp filter access-list 144

[thiland · Accepted solution]

I haven't looked closely at EPC on the switching platforms, but you're capturing CEF switched packets (transit)

monitor capture point ip cef icmptrace all both

When you're sending or receiving ICMP packets from the switch CLI, those are process switched.  Try changing your capture point to "process-switched" or "from-us" instead of CEF.

[Jose Solano]

Hi,

The embedded packet capture (EPC) does not appear to capture packets because EPC is not supported on the 2960 platform even though EPC commands are accepted.

This is considered a bug, since commands are accepted but they do not work because of platform limitations. This issue affects other platforms as well like the 3750 and 3560.

This is the link with the information about the bug is the following:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCui33787

If you want to take a capture the option is to do a SPAN session.

Regards,

Jose

[dspender]

Thank you! I changed that option and can now capture packets.

Wonderful!