I love the ability Cisco's Embedded Packet Capture (EPC) provides to remotely troubleshoot dataflows on IOS routers.
monitor capture buffer CAP_BUF monitor capture point ip cef CAP_PT gig 0/0.1 both monitor capture point associate CAP_PT CAP_BUF monitor capture point start all
However, when the dataflow is NAT'ed I am only able to see the packets inbound to the router in EPC and not the outgoing NAT'ed packets. I have tried changing the 'cef' option to 'process-switched' but still no NAT'ed packets are captured.
Is there a way to capture the outbound packets?
I'd prefer to see them after they've been NAT'ed but I'll take the un-NAT'ed packets if that's all that's possible.