Cisco IOS XE Packet Capture Made Easy

Welcome to Network Engineer Pro. I’m Rafael, CCIE #64356.

I’m working on ton of content (videos, labs and more) to help you learn networking. If you want to stay up to date on what I’m working on and be the first to know then head to my website where you can sign up and get notified:
➤ https://www.networkengineerpro.com/

You can also follow me on Facebook:
➤ https://www.facebook.com/NetworkEngineerPro

Amazon affiliate links to recommended reading material

The CCNA 200-301 Official Cert Guide Volume 1
➤ https://amzn.to/3AWwjXh

The CCNA 200-301 Official Cert Guide Volume 2
➤ https://amzn.to/3wv81QQ

For those of you who want to take your studies to the CCIE level, here are the first two books(of many) you should get your hands on.

Routing TCP/IP, Volume 1
➤ https://amzn.to/3ARnVZj

Routing TCP/IP, Volume 2
➤ https://amzn.to/3k8wfxB

————————————————
Packet captures are simply awesome. They don’t just prove it’s « not » the network but it helps us really learn the protocols in detail.

The Cisco IOS and IOS XE embedded packet capture feature allows us to capture packets that flow through the router. We can capture packets in the inbound or outbound direction or both !

You have the ability to capture everything, or make it super granular by combining it with an access list.

In this video I talk about the feature briefly then we hit the CLI and configure it on a router running IOS XE.

I show you how to configure it to capture all packets then how to configure just OSPF packets that cross the link. Once the capture is complete, just export it to a TFTP server and Wireshark it up!
—————————————–
Config used on R1
monitor capture TEST int g1.100 both
monitor capture TEST match any
monitor capture TEST start
monitor capture TEST stop
monitor capture TEST export tftp://x.x.x.x/mycapture.pcap

Use an extended access-list to capture only OSPF packets
ip access-list extended ONLY-OSPF
permit ospf any any
!
monitor capture TEST access-list ONLY-OSPF

Helpful Show Commands
show monitor capture TEST
show monitor capture TEST buffer
show monitor capture TEST buffer brief
—————————————————
Turn your laptop into a TFTP server, this is what I use and it’s FREE!
https://www.solarwinds.com/free-tools/free-tftp-server

Be sure to check the official documentation for features and protocols you are going to work with.
Cisco Configuration Guide
https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/epc/configuration/xe-3s/epc-xe-3s-book.html

#CCNA #CCNP #CCIE

Views : 5969
network engineer

Source by Network Engineer Pro