Cisco IOS-XE Embedded Packet Capture: EPC Runbook

Embedded Packet Capture (EPC) puts a capture engine inside IOS-XE: you define a buffer and a capture point, filter what you want, then export a PCAP for Wireshark. It is the right tool when you need the packet on the device that is actually dropping it and no SPAN destination is available. This runbook covers configuration, monitoring and export, plus the limitations that make people prefer SPAN when they have the choice.

Define the Capture Buffer

monitor capture buffer CAP1 size 8192 max-size 1518
monitor capture buffer CAP1 circular

Size in kilobytes, and max-size sets the largest packet stored. Circular mode keeps the newest packets and is almost always what you want for intermittent faults; a linear buffer stops when full. Add a filter to avoid filling the buffer with noise:

ip access-list extended CAP-FILTER
 permit ip host 10.10.10.10 any
 permit ip any host 10.10.10.10
monitor capture buffer CAP1 filter access-list CAP-FILTER

Define the Capture Point

monitor capture point ip cef POINT1 GigabitEthernet0/0/1 both
monitor capture point associate POINT1 CAP1

Capture points can be ip cef (hardware-accelerated, CEF path), ip process-switched (traffic punted for software processing) or interface-based. Use cef for normal forwarding path traffic, and remember that a point matched to one direction (in, out or both) has to be chosen deliberately: capturing both on a busy link fills the buffer twice as fast.

Start, Inspect, Stop

monitor capture point start POINT1
show monitor capture point POINT1
show monitor capture buffer CAP1 dump
show monitor capture buffer CAP1 parameters
monitor capture point stop POINT1

Reproduce the fault while the capture runs. The dump command prints a summary of what is in the buffer - packet count, timestamps, and the first packets - which is often enough to confirm whether the traffic is arriving at all before you export anything.

Export to Wireshark

monitor capture buffer CAP1 export tftp://10.0.0.50/cap1.pcap
! or to flash, then copy off-box
monitor capture buffer CAP1 export flash:cap1.pcap

Export produces a standard PCAP; open it in Wireshark or feed it into tshark for scripted analysis. Also clear the buffer between runs - an uncleared buffer produces captures that mix two incidents, which is a subtle way to waste an hour.

Practical Limits and Alternatives

• EPC captures what the router sees at the chosen point, not what the endpoint sent: VLAN tags and encapsulation are as the interface presents them, so captures from trunks need to be read with that in mind.
• Performance impact is real on software capture points; always use filters and stop the capture when finished.
• For long or high-rate captures, use SPAN to a real capture host instead - the multi-vendor procedures are in port mirroring and SPAN.
• Pair EPC with counter and flow views for a complete picture: flow records in NetFlow v9 configuration, alternative flow exports in sFlow versus NetFlow versus IPFIX, path-level evidence in mtr for packet loss and latency and reachability probing in IP SLA with track objects.

原文链接：https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/epc/configuration/xe-16/epc-xe-16-book.html