Remote Packet Capture in Cisco IOS

Sometimes you need a network packet capture but you don't have access to the network. That's the time for Cisco's "Embedded Packet Capture"

Lets say you want to capture the traffic on you Cisco IOS routers LAN interface. You need about 2 megabyte circular buffer.

monitor capture buffer buf1 size 2048 circular
monitor capture point ip cef cap1 gigabitethernet0/0 both 

monitor capture point associate cap1 buf1

Start the capture with:

monitor capture point start cap1

And stop the capture with:

monitor capture point stop cap1

Check if everything you need is in the trace:

show monitor cap buffer buf1 dump

And copy it to a place, in this case flash, where you can access it:

monitor capture buffer buf1 export flash:capture.pcap

You might want to download it for example via SCP. There is a seperate entry in this blog regarding SCP: http://uc-b.blogspot.com/2011/07/putty-scp-file-transfer-to-cisco-ios.html

But you could also copy it directly to a bunch of remote locations:

router#monitor capture buffer buf1 export ?

  flash0:  Location to dump buffer

  flash1:  Location to dump buffer

  flash:   Location to dump buffer

  ftp:     Location to dump buffer

  http:    Location to dump buffer

  https:   Location to dump buffer

  pram:    Location to dump buffer

  rcp:     Location to dump buffer

  scp:     Location to dump buffer

  tftp:    Location to dump buffer

router#

Cisco Link to embedded Packet Capture:
http://www.cisco.com/en/US/docs/ios/netmgmt/configuration/guide/nm_packet_capture_ps6441_TSD_Products_Configuration_Guide_Chapter.html

If you want to automate it in a quite fancy way you should have a look at Cisco Embedded Automation Systems - EASy
http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6555/ps10777/ppt_EASy_Packet_Capture_c78-577851.pdf