An interesting useful tool available in IOS 12.4(20)T and prior : Embedded Packet Capture (EPC). This tool is useful to avoid configure SPAN and RSPAN to be able to capture and analyze trafic.
You can now do it by means of defining a capture buffer, then a capture point, link them and start the capture.
Then you can upload this capture (in pcap) and read analyze it with wireshark 🙂
R1#monitor capture buffer TEST_BUFFER size 512 max-size 128 circular R1#sh monitor capture buffer all parameters Capture buffer TEST_BUFFER (circular buffer) Buffer Size : 524288 bytes, Max Element Size : 128 bytes, Packets : 0 Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0 Associated Capture Points: Configuration: monitor capture buffer TEST_BUFFER size 512 max-size 128 circular
Then configure the capture point :
R1#monitor capture point ip cef TEST_CP-1 fa 1/0 both *Feb 13 18:32:36.039: %BUFCAP-6-CREATE: Capture Point TEST_CP-1 created. R1#monitor capture point ip process-switched TEST_CP-2 from-us *Feb 13 18:32:41.535: %BUFCAP-6-CREATE: Capture Point TEST_CP-2 created. R1#sh monitor capture point all Status Information for Capture Point TEST_CP-2 IPv4 Process Switch Path: IPv4 Process , Capture Buffer: None Status : Inactive Configuration: monitor capture point ip process-switched TEST_CP-2 from-us Status Information for Capture Point TEST_CP-1 IPv4 CEF Switch Path: IPv4 CEF , Capture Buffer: None Status : Inactive Configuration: monitor capture point ip cef TEST_CP-1 FastEthernet1/0 both
Then, we associate buffer to capture point :
R1#monitor capture point associate TEST_CP-1 TEST_BUFFER R1#sh monitor capture point all Status Information for Capture Point TEST_CP-2 IPv4 Process Switch Path: IPv4 Process , Capture Buffer: TEST_BUFFER Status : Inactive Configuration: monitor capture point ip process-switched TEST_CP-2 from-us Status Information for Capture Point TEST_CP-1 IPv4 CEF Switch Path: IPv4 CEF , Capture Buffer: TEST_BUFFER Status : Inactive Configuration: monitor capture point ip cef TEST_CP-1 FastEthernet1/0 both R1#sh monitor capture buffer all parameters Capture buffer TEST_BUFFER (circular buffer) Buffer Size : 524288 bytes, Max Element Size : 128 bytes, Packets : 0 Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0 Associated Capture Points: Name : TEST_CP-1, Status : Inactive Name : TEST_CP-2, Status : Inactive Configuration: monitor capture buffer TEST_BUFFER size 512 max-size 128 circular monitor capture point associate TEST_CP-1 TEST_BUFFER monitor capture point associate TEST_CP-2 TEST_BUFFER
Then:
R1#monitor capture point start TEST_CP-2 R1# *Feb 13 18:45:48.495: %BUFCAP-6-ENABLE: Capture Point TEST_CP-1 enabled. *Feb 13 18:45:49.495: %BUFCAP-6-ENABLE: Capture Point TEST_CP-2 enabled. R1#sh monitor capture point all Status Information for Capture Point TEST_CP-2 IPv4 Process Switch Path: IPv4 Process , Capture Buffer: TEST_BUFFER Status : Active Configuration: monitor capture point ip process-switched TEST_CP-2 from-us Status Information for Capture Point TEST_CP-1 IPv4 CEF Switch Path: IPv4 CEF , Capture Buffer: TEST_BUFFER Status : Active Configuration: monitor capture point ip cef TEST_CP-1 FastEthernet1/0 both R1#sh monitor capture buffer all parameters Capture buffer TEST_BUFFER (circular buffer) Buffer Size : 524288 bytes, Max Element Size : 128 bytes, Packets : 0 Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0 Associated Capture Points: Name : TEST_CP-1, Status : Active Name : TEST_CP-2, Status : Active Configuration: monitor capture buffer TEST_BUFFER size 512 max-size 128 circular monitor capture point associate TEST_CP-1 TEST_BUFFER monitor capture point associate TEST_CP-2 TEST_BUFFER
Do some stuff and wait for traffic :
R1#ping 10.0.1.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.0.1.2, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms R1#sh monitor capture buffer TEST_BUFFER 18:51:47.483 UTC Feb 13 2011 : IPv4 Process : None Fa1/0 18:51:47.491 UTC Feb 13 2011 : IPv4 CEF Turbo : Fa1/0 None 18:51:47.491 UTC Feb 13 2011 : IPv4 LES CEF : Fa1/0 None 18:51:47.499 UTC Feb 13 2011 : IPv4 Process : None Fa1/0 18:51:47.503 UTC Feb 13 2011 : IPv4 CEF Turbo : Fa1/0 None 18:51:47.503 UTC Feb 13 2011 : IPv4 LES CEF : Fa1/0 None 18:51:47.503 UTC Feb 13 2011 : IPv4 Process : None Fa1/0 R1#sh monitor capture buffer TEST_BUFFER dump 18:51:50.023 UTC Feb 13 2011 : IPv4 CEF Turbo : Fa1/0 None 672C4650: CA003713 001CCA01 3713001C J.7...J.7... 672C4660: 08004500 00640009 0000FE01 A68D0A00 ..E..d....~.&... 672C4670: 01020A00 01010000 DCA70001 00040000 ........'...... 672C4680: 0000002D A970ABCD ABCDABCD ABCDABCD ...-)p+M+M+M+M+M 672C4690: ABCDABCD ABCDABCD ABCDABCD ABCDABCD +M+M+M+M+M+M+M+M 672C46A0: ABCDABCD ABCDABCD ABCDABCD ABCDABCD +M+M+M+M+M+M+M+M 672C46B0: ABCDABCD ABCDABCD ABCDABCD ABCDABCD +M+M+M+M+M+M+M+M 672C46C0: ABCDABCD ABCD00 +M+M+M. 18:51:50.023 UTC Feb 13 2011 : IPv4 LES CEF : Fa1/0 None 672C4650: CA003713 001CCA01 3713001C J.7...J.7... 672C4660: 08004500 00640009 0000FE01 A68D0A00 ..E..d....~.&... 672C4670: 01020A00 01010000 DCA70001 00040000 ........'...... 672C4680: 0000002D A970ABCD ABCDABCD ABCDABCD ...-)p+M+M+M+M+M 672C4690: ABCDABCD ABCDABCD ABCDABCD ABCDABCD +M+M+M+M+M+M+M+M 672C46A0: ABCDABCD ABCDABCD ABCDABCD ABCDABCD +M+M+M+M+M+M+M+M 672C46B0: ABCDABCD ABCDABCD ABCDABCD ABCDABCD +M+M+M+M+M+M+M+M 672C46C0: ABCDABCD ABCD00 +M+M+M.
You can now export this capture by means of lot of remote transfert protocol :
R1#monitor capture buffer TEST_BUFFER export ? ftp: Location to dump buffer http: Location to dump buffer https: Location to dump buffer pram: Location to dump buffer rcp: Location to dump buffer scp: Location to dump buffer tftp: Location to dump buffer
Source : http://routerjockey.com/2011/02/14/ios-embedded-packet-capture/ from @tonhe
Cisco : EPC (Embedded Packet Capture)