Packet Capture in Cisco IOS

From Teknologisk videncenter
Jump to: navigation, search
!<notice>An ACL must be defined to match interesting traffic only:</notice>
ip access-list extended Monitored-Host
 permit ip host
!<notice>A buffer must be defined and bounded to the previos defined ACL:</notice>
monitor capture buffer BUFFER size 10000 max-size 1500 circular
monitor capture buffer BUFFER filter access-list Monitored-Host
!<notice>The next step requires to define which interfaces must be monitoed and where store data:</notice>
monitor capture point ip cef CAPTURE FastEthernet0/0 both
monitor capture point associate CAPTURE BUFFER
!<notice>Finally the capture must be started and stopped when not needed anymore:</notice>
monitor capture point start CAPTURE
monitor capture point stop CAPTURE
!<notice>At this point the buffer can be exported to an external system:</notice>
monitor capture buffer BUFFER export