Packet Capture is empty on Cat9300

[Bill]

I am trying to get a packet capture on a physical port (or VLAN interface) on a Cat 9300 running version 16.6.6
But it does not capture any traffic.

I think I have the capture set up correctly.
If I set it to use a different interface, it works.

I can see the output packet counters incrementing on the interface.
But it does not capture the traffic.

The port is connected to a Service Provider who says they are not receiving any traffic.
I wanted to prove them wrong, but now I am not so sure.

Seems real simple.
I have a Trunked interface using Tagged VLAN 271 with a /30 subnet.
I have a PC running a constant ping to the remote device at 10.255.254.2.

Here is the relevant switch config and some show commands:

interface Vlan271
ip address 10.255.254.1 255.255.255.252

interface GigabitEthernet1/0/48
switchport trunk allowed vlan 71,271-275
switchport mode trunk

#sh ip int br
Interface IP-Address OK? Method Status Protocol
Vlan271 10.255.254.1 YES manual up up

#sh int vl 271
Vlan271 is up, line protocol is up
Internet address is 10.255.254.1/30
16787 packets output, 1007220 bytes, 0 underruns

#sh int g1/0/48
GigabitEthernet1/0/48 is up, line protocol is up (connected)
14922493 packets output, 1104911119 bytes, 0 underruns

Output counters are constantly incrementing.

Here is the Capture config:
ip access-list extended MyCap-ACL
permit ip 10.255.254.0 0.0.0.255 any
permit ip any 10.255.254.0 0.0.0.255

monitor capture MyCap access-list MyCap-ACL
monitor capture MyCap limit packets 1000
monitor capture MyCap interface GigabitEthernet 1/0/48 both

Also tried:  monitor capture MyCap interface vlan271 both

monitor capture MyCap start

monitor capture MyCap stop
Capture statistics collected at software:
Capture duration - 75 seconds
Packets received - 0
Packets dropped - 0
Packets oversized - 0
Packets dropped in asic - 0

Could it be that the switch is ARPing for the remote device and the Capture doesn't pick that up?

I tried 'IP any any" for the ACL, but still empty.

Thanks

[brselzer · Accepted solution]

Hello,

Correct. If you do not have ARP resolved, you will ARP for the packet before you send it. An ARP packet does not have an IPv4 header so it will not be captured. Try to use this command to see if you can capture the ARP packets:

monitor capture MyCap interface GigabitEthernet 1/0/48 both match any

This should capture anything on the interface including L2 frames like ARP. 

Hope that helps!

[Bill]

Thank you Bradley for the quick response and the correct answer.

That command worked perfect.

As expected, I could see the ARP requests going out the interface.

Thanks again.