Trouble Capturing Packets with Embedded Packet Capture

[Rowell Dionicio]

Hi All,

I am trying to capture packets originating from a server to a host device across three switches:

server -- 6513 -- 3850 -- 3550 -- host A

I am doing a ping from the server to host A. The packet capture is being done on the 3850. This is my configuration:

access-list 100 permit icmp host 192.168.101.6 host 192.168.100.188
access-list 100 permit icmp host 192.168.100.188 host 192.168.101.6
end

monitor capture buffer TRACE
monitor capture buffer TRACE filter access-list 100
monitor capture point ip cef CAP g1/1/1 both
montior capture point associate CAP TRACE
monitor capture point start CAP

I then issue a ping from the server to host A. Interface g1/1/1 is where the 6513 connects to the 3850. When I issue a show monitor capture buffer all parameters, there are no packets. If I remove the filter from the buffer I still do not see the packets.

Does anyone have any advice here?

[cadet alain]

Hi,

Can you post the output of show monitor capture buffer all

as well as output of  show monitor capture buffer TRACE parameters

And also a sh run int G1/1/1

Regards

Alain

[Rowell Dionicio]

I tried recreating the packet capture with no access-list filtering.

show mon cap buff all para
Capture buffer cap (circular buffer)
Buffer Size : 1048576 bytes, Max Element Size : 68 bytes, Packets : 0
Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0
Associated Capture Points:
Name : cap, Status : Active
Configuration:
monitor capture buffer cap circular
monitor capture point associate cap cap

interface GigabitEthernet1/1/1
 description UPLINK TO 6513
 switchport mode trunk
end

[cadet alain]

Hi,

This feature only works on L3 interfaces as far as I know, if you want to monitor a L2 link then you have to use SPAN or RSPAN feature.

Regards

Alain