How to capture packets in the forwarding path on NCS 540 7.3.2

[jhammond75]

Have an NCS540 running 7.3.2 and want to capture and examine packet traffic

[tkarnani]

you can try this tool, span to file

https://community.cisco.com/t5/service-providers-knowledge-base/7-1-2-feature-introduction-span-to-file/ta-p/4652573

[jhammond75]

Thank you. I tried that and here's what I got

(config)#monitor-session TEST ethernet
(config-mon)#destination file size 10000
RP/0/RP0/CPU0:N540-1-LG2-A238(config-mon)#exit
RP/0/RP0/CPU0:N540-1-LG2-A238(config)#int Te0/0/0/8
RP/0/RP0/CPU0:N540-1-LG2-A238(config-if)#monitor-session TEST ethernet port-level
RP/0/RP0/CPU0:N540-1-LG2-A238(config-if-mon)#exit
RP/0/RP0/CPU0:N540-1-LG2-A238(config-if)#exit
RP/0/RP0/CPU0:N540-1-LG2-A238(config)#monitor-session TEST ?
destination Specify the destination that traffic should be replicated to
discard-class Specify the discard class value to be set on all traffic mirrored to th
e destination
ethernet Replicate Ethernet traffic
inject-interface Specify the attachment interface into which traffic may be injected fro
m the SPAN session's destination
traffic-class Specify the traffic class value to be set on all traffic mirrored to th
e destination
<cr>

packet-collection start not an option.

I'm sure this is user error

[tkarnani]

to start the packet collection you need to be in exec-mode not config mode

[filopeter]

Hello, could you please let us know if "span to file" should be supported also on NCS540 running XR7?

[jhammond75]

Thank you. would that be the admin command. 

RP/0/RP0/CPU0:N540-1-LG2-A238#monitor-session
^
% Invalid input detected at '^' marker.

[tkarnani]

admin is not required

RP/0/RP0/CPU0:NCS-540-A#monitor-session test packet-collection st
start stop
RP/0/RP0/CPU0:NCS-540-A#monitor-session test packet-collection st?
start stop
RP/0/RP0/CPU0:NCS-540-A#monitor-session test packet-collection start ?
<cr>
RP/0/RP0/CPU0:NCS-540-A#monitor-session test packet-collection start

do you have tacacs enabled that may be blocking this command?

Thank you

[jhammond75]

Thank you
RP/0/RP0/CPU0:N540-1-LG2-A238#monitor-session test packet-collection start ?
^
% Invalid input detected at '^' marker.

RP/0/RP0/CPU0:N540-1-LG2-A238#show tacacs
Mon Jan 23 17:04:42.508 UTC
RP/0/RP0/CPU0:N540-1-LG2-A238#
RP/0/RP0/CPU0:N540-1-LG2-A238#show tacacs requests
Mon Jan 23 17:06:05.607 UTC
RP/0/RP0/CPU0:N540-1-LG2-A238#

[tkarnani]

can you check show user group, make sure your account has cisco-support and rootsystem group privileges

thanks