I love the ability Cisco's Embedded Packet Capture (EPC) provides to remotely troubleshoot dataflows on IOS routers.

monitor capture buffer CAP_BUF
monitor capture point ip cef CAP_PT gig 0/0.1 both
monitor capture point associate CAP_PT CAP_BUF
monitor capture point start all

However, when the dataflow is NAT'ed I am only able to see the packets inbound to the router in EPC and not the outgoing NAT'ed packets. I have tried changing the 'cef' option to 'process-switched' but still no NAT'ed packets are captured.

Is there a way to capture the outbound packets?

I'd prefer to see them after they've been NAT'ed but I'll take the un-NAT'ed packets if that's all that's possible.

  • You may want to use NetFlow. Also, understand that running such things as packet capture on your router can greatly increase the CPU load and reduce routing performance. If you are running one of the newer codes that runs IOS as an image in Linux, you can use Wireshark to capture such things. – Ron Maupin Dec 6 at 15:30
  • Thank you. Netflow, via top-talkers, is very useful for establishing what is talking. Unfortunately there are times where we need to remotely see the packet contents. Our traffic is so light that I'm not concerned with overloading the router. We are running on ISR G2s that do not support IOS XE. – Stephen Craven Dec 6 at 15:42

If your outbound interface is an ethernet interface, then you could use an ethernet switch on the outside of your router to mirror the traffic to an interface that has a monitoring device connected.

Using an external switch will free your router from the burden of trying to perform the capture.

  • This is a good suggestion. In our case we have hundreds of unmanned branch locations that cannot be easily physically modified, so the EPC capability is a godsend. – Stephen Craven Dec 7 at 14:51
  • What capture capabilities does the firewall have? Shouldn't you be doing NAT on the firewall rather than the router? – Ron Maupin Dec 8 at 1:13
  • Unfortunately there is no firewall at these locations. – Stephen Craven 2 days ago
  • That is very, very foolish. There is nothing stopping someone from taking over one of your sites. It may have already happened. – Ron Maupin 2 days ago

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.