Showing results for 
Search instead for 
Did you mean: 

How to Capture Packets on Cisco Devices


We all know that sometimes we need to see the packets. Often however, getting a packet capture  in the right place, or spanning the right VLAN’s, can take time. To make capturing packets easier, many Cisco products allow packet captures to be done directly on the devices. This is a handy reference to "how to" documents for Cisco products that support packet capture.

On Cisco IOS, there is Enhanced Packet Capture (EPC):

On Cisco IOS-XE (ASR), EPC was introduced in 3.7.0:

For the 7600 platform, there is a similar concept called Mini Protocol, which extends EPC into the hardware forwarding path:

For the ASA, FWSM and PIX products, you can capture ingress and egress packets via the CLI and ADSM:

Additionally, you can capture packets which were dropped by the Accelerated Security Path (ASP) within the ASA and PIX by using a capture type of "asp-drop".

The Nexus platform has built in WireShark capability:

On the Wireless LAN Controller (WLC), you can trace packets to/from the CPU with the debug packet logging facility:

On the Cisco Unified Communications Manager (CUCM), Unity Connection (UC), Cisco Unified Presence Server (CUP), and Unified Contact Center Express (UCCX), packets can be captured on the Command Line Interface (CLI):

It is possible to capture packets on a PC connected to the back of a Cisco IP Phone:

The ACS 5.x can show you the text output of a standard TCPDump:

It's best to redirect that to a file when using SSH/telnet so you don't see your own management traffic, so "tech dumptcp 0 > my-cap.txt".


Thanks for consolidating this into one page, Julie!

Quick note, the ASR9k dbg tool link appears there an alternate?

Julie Burruss

It's been updated, thanks!

Minh Le
Cisco Employee

What about the "Router IP Traffic Export Packet Capture Enhancements" feature:

Jordan Dalley

I wrote a howto for importing pcap's out of a cisco router into wireshark for packet inspection here:


Hi Julie, this is a great summary of capturing capabilities across most platforms ... except for the one I need

What about capturing packets on a CRS router with IOS-XR?  Disappointingly IOS-XR doesn't seem to support EPC. There is a packet  capture interface configuration command, but after entering it we can't  commit - probably isn't supported in our s/w version (4.1.2). Would you  know any other way of capturing on a CRS?



After having this bookmarked 3/4-year ago, utilizing it today for 1st time by sniffing 3G WAN interface on ISR G2 router - was a beauty. Great tool!