Cisco IOS XE Packet Capture Made Easy

Welcome to Network Engineer Pro. I'm Rafael, CCIE #64356.

I'm working on ton of content (videos, labs and more) to help you learn networking. If you want to stay up to date on what I'm working on and be the first to know then head to my website where you can sign up and get notified:

You can also follow me on Facebook:

Amazon affiliate links to recommended reading material

The CCNA 200-301 Official Cert Guide Volume 1

The CCNA 200-301 Official Cert Guide Volume 2

For those of you who want to take your studies to the CCIE level, here are the first two books(of many) you should get your hands on.

Routing TCP/IP, Volume 1

Routing TCP/IP, Volume 2

------------------------------------------------
Packet captures are simply awesome. They don't just prove it's "not" the network but it helps us really learn the protocols in detail.

The Cisco IOS and IOS XE embedded packet capture feature allows us to capture packets that flow through the router. We can capture packets in the inbound or outbound direction or both !

You have the ability to capture everything, or make it super granular by combining it with an access list.

In this video I talk about the feature briefly then we hit the CLI and configure it on a router running IOS XE.

I show you how to configure it to capture all packets then how to configure just OSPF packets that cross the link. Once the capture is complete, just export it to a TFTP server and Wireshark it up!
-----------------------------------------
Config used on R1
monitor capture TEST int g1.100 both
monitor capture TEST match any
monitor capture TEST start
monitor capture TEST stop

Use an extended access-list to capture only OSPF packets
ip access-list extended ONLY-OSPF
permit ospf any any
!
monitor capture TEST access-list ONLY-OSPF

Helpful Show Commands
show monitor capture TEST
show monitor capture TEST buffer
show monitor capture TEST buffer brief
---------------------------------------------------
Turn your laptop into a TFTP server, this is what I use and it's FREE!

Be sure to check the official documentation for features and protocols you are going to work with.
Cisco Configuration Guide

#CCNA #CCNP #CCIE

[marcjohnson]

This is the best explanation of embedded packet capture I've seen. Great job!

[JoshuaBeckettSLHS]

Your videos are quite engaging and explain things in a very practical sense. I've stumbled across them a few times while studying. Please keep making more. :)

[CoDeC__]

Thanks for a detailed explanation. I have a question, instead of send the capture "offline", can be configured for send the captures to server on-fly instead save in the internal buffer? thanks

[charan_]

Simple and to the point, fantastic work.

[arunplatina]

Thanks Rafael for this video, really helps, we need more Realtime stuffs like this

[anupsasikumar.online]

Thank you for the crisp and easy video of EPC!

Quick question, Rafael - Do we have to be mindful when trying to run this in the production environments?
Like debugs, does it take a lot of CPU ?

Also whats the major difference between Debugs and EPC ?

[ej]

Great video. I'm trying to do this on a 3850. The capture works but the ACL filter is not applied, any ideas?

[Hyperion-Prime]

hi Rafael. great video and well explained. how would i go about configuring a capture where i ping using a lan interface as a source to an external destination via the WAN interface? i want to be able to capture the icmp request and reply

[Bormanb]

Very easy and concise explanation, very good and thank you so much!

[chadlewis]

Well done! Thank you very much for this tutorial.

[vijaycisco]

hi bro instead of using tftp to export ; if we use scp or https then what could be the correct syntax that we need to type on router cli ?

[RicardoDiaz]

Great video. Easy to follow, learned something new :)