An interesting useful tool available in IOS 12.4(20)T and prior : Embedded Packet Capture (EPC). This tool is useful to avoid configure SPAN and RSPAN to be able to capture and analyze trafic.
You can now do it by means of defining a capture buffer, then a capture point, link them and start the capture.
Then you can upload this capture (in pcap) and read analyze it with wireshark :)
R1#monitor capture buffer TEST_BUFFER size 512 max-size 128 circular
R1#sh monitor capture buffer all parameters
Capture buffer TEST_BUFFER (circular buffer)
Buffer Size : 524288 bytes, Max Element Size : 128 bytes, Packets : 0
Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0
Associated Capture Points:
Configuration:
monitor capture buffer TEST_BUFFER size 512 max-size 128 circular
Then configure the capture point :