Packet Capture on 2960X switch interface

[aravikumar]

Hello,

I have configured the following commands to capture packet on switch trunk interface.

monitor capture buffer BUFFER NAME

monitor capture point ip cef POINT gigabitEthernet INTERFACE-NUMBER both

monitor capture point associate POINT BUFFER

monitor capture point start POINT

When I try to export the captured packets, there were no packets in the exported pcap file.

Am I missing something here or is there a defect?

Switch model and IOS version:

Switch Ports            Model                       SW Version       SW Image
------ -----          -----                     ----------       ----------
* 1        28        WS-C2960X-24PD-L    15.2(4)E6      C2960X-UNIVERSALK9-M

Please help.

Thanks,

Aravind.

[Reza Sharifi]

Hi,

Not all SPAN features are supported on the 2960x series switches. What is your license level? "sh ver" should show you that.

HTH

[aravikumar]

Hi Reza,

The following is the show version of the switch

Cisco IOS Software, C2960X Software (C2960X-UNIVERSALK9-M), Version 15.2(4)E6, RELEASE SOFTWARE (fc4)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2018 by Cisco Systems, Inc.
Compiled Thu 05-Apr-18 02:53 by prod_rel_team

ROM: Bootstrap program is C2960X boot loader
BOOTLDR: C2960X Boot Loader (C2960X-HBOOT-M) Version 15.2(4r)E3, RELEASE SOFTWARE (fc4)

WS-C2960X-24PD-L-01 uptime is 2 weeks, 2 days, 6 hours, 45 minutes
System returned to ROM by power-on
System restarted at 05:48:27 EST Mon Jun 17 2019
System image file is "flash:/c2960x-universalk9-mz.152-4.E6.bin"
Last reload reason: Reload command

This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.

A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by sending email to
export@cisco.com.

cisco WS-C2960X-24PD-L (APM86XXX) processor (revision A0) with 524288K bytes of memory.
Processor board ID FOC1806S4WC
Last reset from reload command
2 Virtual Ethernet interfaces
1 FastEthernet interface
26 Gigabit Ethernet interfaces
2 Ten Gigabit Ethernet interfaces
The password-recovery mechanism is enabled.

512K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address : B0:00:B4:2D:D7:00
Motherboard assembly number : 73-14189-04
Power supply part number : 341-0528-01
Motherboard serial number : FOC18061WUE
Power supply serial number : LIT175108W4
Model revision number : A0
Motherboard revision number : A0
Model number : WS-C2960X-24PD-L
Daughterboard assembly number : 73-14200-03
Daughterboard serial number : FOC18052ELH
System serial number : FOC1806S4WC
Top Assembly Part Number : 800-38003-01
Top Assembly Revision Number : C0
Version ID : V01
CLEI Code Number : CMMLL00ARA
Daughterboard revision number : A0
Hardware Board Revision Number : 0x05

Switch Ports Model SW Version SW Image
------ ----- ----- ---------- ----------
* 1 28 WS-C2960X-24PD-L 15.2(4)E6 C2960X-UNIVERSALK9-M

Configuration register is 0xF

Thanks,

Aravind.

[balaji.bandi]

c2960x-universalk9-mz.152-4.E6.bin  - you have lanbase-lan lite image.

here is the restriction look the release notes :

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15_2_6_e/configuration_guide/b_1526e_consolidated_2960x_cg/b_1526e_consolidated_2960x_cg_chapter_01011011.html

[Martin L]

sorry, but SPAN , RSPAN is not same as Packet capture, right?

[tyoung008]

TAC told me EPC is not supported on the 2960X and other switches.  Even though the 2960X does not appear on the list of products on this bug -> https://bst.cloudapps.cisco.com/bugsearch/bug/CSCui33787, it appears to also apply to the 2960X.  On a side note, using the options "process-switch" "from-us" seems to be able to capture packets from the switch.