[c-nsp] Embedded Packet Capture on ASR-920

[Nick Cutting]

That is the exact config I used also, from the same webpage 

I tried both CEF and process - although the traffic I wanted to see was through the router and not to the router.  I didn't even see a single packet.
I ended up spanning the traffic from the switch.

The ASR1k supports the" easy style" one line embedded capture also, and just works

-----Original Message-----
From: cisco-nsp [mailto:cisco-nsp-bounces at puck.nether.net] On Behalf Of James Bensley
Sent: Friday, June 23, 2017 10:10 AM
To: cisco-nsp at puck.nether.net
Subject: Re: [c-nsp] Embedded Packet Capture on ASR-920

On 21 Jun 2017 22:55, "Nick Cutting" <ncutting at edgetg.com> wrote:

Has anyone used this?
I have used it on other IOS-XE routers 44xx/3xxx with no issues.

My captures are empty on the ASR-920


Code running is:

03.18.01.SP.156-2.SP1-ext

Any experiences greatly welcomed.

Nick


Hi Nick,

What traffic are you trying to capture? I got this working as per these notes (I had done something similar on ASR1000s but it turns out the syntax is slightly different on the ASR920):
https://null.53bits.co.uk/index.php?page=embedded-packet-capture-epc

However that was a while ago, if I recall correctly I had was PPPoE traffic tagged in a specific VLAN that I wanted to inspect and this wasn't showing up in the traffic capture so I ended up having to SPAN the port on the neighbouring device. So I think it's not perfect and possibly not even sure its supported. I didn't bother with TAC as the SPAN worked fine and I haven't needed it since.

Cheers,
James.
_______________________________________________
cisco-nsp mailing list  cisco-nsp at puck.nether.net https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/