In quite a few instances I found myself in a situation where, for troubleshooting & traffic flow analysis purposes, I just wanted to get a capture of the traffic going over a specific link or between specific networks. There is few ways I could think of to achieve this:
- Configure SPAN (on switches, for L2 traffic only)
- Use a dedicated hardware device in-line with the traffic flow – likely, downtime involved
- Use Netflow – but that’s probably, not complex, rather inconvenient at times; also, some devices require specific license for NetFlow
You would then get the traffic in a pcap format and load it in Wireshark.
But there is also yet another way, through Cisco Embedded Packet Capture (EPC) feature. Now here are few things you need to consider when implementing this feature:
- all configuration is done in privilege mode
- the configuration is not saved; hence, it doesn’t persists upon reloads – it doesn’t show in show run either!
- can capture both CEF (cached L3), as well as Process Switched packets
- can capture both IPv4 and IPv6 traffic
- can be enabled for physical interfaces, sub-interfaces and tunnel interfaces
- it is *not* available on switches
- capture can be later exported to an external server via tftp, ftp, scp, etc.
- requires at least Cisco IOS Release 12.4(20)T or later
So I will show you next how easy it is to implement this; I will be working on the following network:
R1 is a Cisco 7200 Router running IOS 12.4(24)T; R2 is a Cisco 2691 running IOS 12.4(25d). I will configure EPC on R1 so that it captures all IPv4 traffic flowing in/out interface Fa0/0.
Once exported, we could then open the .pcap file in Wireshark – see screenshot below: