05-18-2016 09:53 AM - edited 03-08-2019 05:49 AM
I have a C2960x Switch running IOS Version 15.2(2)E3. I have a PC that is plugged into an IP phone, and the phone is plugged into a jack connected to interface gi1/0/28 on the switch. Because the PC is dropping a lot of pings I want to run a capture on the switch port so I can see the packets. I plan to send the output to Wireshark, but even though I believe my capture configuration is correct, I am not seeing any packets being captured as I ping the host. I have made sure to activate my capture point....but it isn't working. Below is the configuration I used. Can anyone tell me what I am doing wrong?
STACK1(config)#ip access-list extended cap
STACK1(config-ext-nacl)#permit ip any any
STACK1(config-ext-nacl)#exit
STACK1#monitor capture buffer buff circular
STACK1#monitor capture buffer buff filter access-list cap
STACK1#monitor capture point ip cef trace gi1/0/28 both
STACK1#monitor cap point associate trace buff
STACK1#show monitor capture buffer buff param
Capture buffer buff (circular buffer)
Buffer Size : 1048576 bytes, Max Element Size : 68 bytes, Packets : 0
Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0
Associated Capture Points:
Name : trace, Status : Active
Configuration:
monitor capture buffer buff circular
monitor capture point associate trace buff
monitor capture buffer buff filter access-list cap
05-18-2016 10:28 PM
Try use commands:
monitor session number source....
and
monitor session number destination....
05-19-2016 11:54 AM
Thanks, Milos. That is what I actually ended up doing...configuring SPAN and having the packets mirrored on another port...but I'm still curious as to why I can't get the embedded packet captures to work.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide