I love the ability Cisco's Embedded Packet Capture (EPC) provides to remotely troubleshoot dataflows on IOS routers.

monitor capture buffer CAP_BUF
monitor capture point ip cef CAP_PT gig 0/0.1 both
monitor capture point associate CAP_PT CAP_BUF
monitor capture point start all

However, when the dataflow is NAT'ed I am only able to see the packets inbound to the router in EPC and not the outgoing NAT'ed packets. I have tried changing the 'cef' option to 'process-switched' but still no NAT'ed packets are captured.

Is there a way to capture the outbound packets?

I'd prefer to see them after they've been NAT'ed but I'll take the un-NAT'ed packets if that's all that's possible.

  • You may want to use NetFlow. Also, understand that running such things as packet capture on your router can greatly increase the CPU load and reduce routing performance. If you are running one of the newer codes that runs IOS as an image in Linux, you can use Wireshark to capture such things.
    – Ron Maupin
    Dec 6 '18 at 15:30
  • Thank you. Netflow, via top-talkers, is very useful for establishing what is talking. Unfortunately there are times where we need to remotely see the packet contents. Our traffic is so light that I'm not concerned with overloading the router. We are running on ISR G2s that do not support IOS XE. Dec 6 '18 at 15:42
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 25 '18 at 10:09

If your outbound interface is an ethernet interface, then you could use an ethernet switch on the outside of your router to mirror the traffic to an interface that has a monitoring device connected.

Using an external switch will free your router from the burden of trying to perform the capture.

  • This is a good suggestion. In our case we have hundreds of unmanned branch locations that cannot be easily physically modified, so the EPC capability is a godsend. Dec 7 '18 at 14:51
  • What capture capabilities does the firewall have? Shouldn't you be doing NAT on the firewall rather than the router?
    – Ron Maupin
    Dec 8 '18 at 1:13
  • Unfortunately there is no firewall at these locations. Dec 10 '18 at 12:40
  • That is very, very foolish. There is nothing stopping someone from taking over one of your sites. It may have already happened.
    – Ron Maupin
    Dec 10 '18 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.