Using filters to capture specific traffic can reduce CPU and memory utilization.Įmbedded Packet Capture is a toolset that actually captures the traffic. Please be aware of typical CPU & memory usage before enabling these features.

Wireshark on IOS XE is also a method of capturing and displaying traffic in IOS XE, however, Wireshark is much more flexible when it comes to working with the captured traffic and displaying the captured traffic on the CLI.įinally, both Wireshark and Embedded Packet Capture can be CPU and Memory intensive processes. In summary, Embedded Packet Capture is a method of capturing and displaying traffic in IOS XE. This article is to help network administrators differentiate between Wireshark and EPC and to show examples of both methods. Wireshark requires a DNA Advantage term license and EPC requires a Network Essentials perpetual license, this has created confusion. Some monitor capture commands in IOS XE use Wireshark others use EPC. SPAN is another way of redirecting traffic to a monitoring destination but has no local display, this article is NOT about SPAN.

Wireshark can also be an application that runs as a container on C9300 and C9400, this article is NOT about that. Wireshark is an application that runs natively inside of IOS XE on the Cat 9k.

You can also use sshdump directly in Wireshark’s GUI.Wireshark and Embedded Packet Capture (EPC) are methods of capturing and or displaying captured traffic on an IOS XE box. This command is functionally equivalent to the commands above: sshdump -extcap-interface=sshdump -capture -remote-host remotehost -remote-username remoteuser -fifo=/some/local/directory/tcpdump.pcap You can now open up the remote capture file by using Wireshark on your computer.Īlternatively, you can use Wireshark’s remote capture tool sshdump. What if you wanted to capture and analyze traffic on a remote server? Wireshark is usually used to analyze traffic on your local network, so you would need to use a tool like tcpdump.įirst, SSH into the remote machine with an account with root access: ssh use tcpdump to capture the traffic on the remote network and save it into a PCAP file: sudo tcpdump -i eth0 -w tcpdump.pcapįinally, copy the capture file to your computer by using the scp command: scp /some/local/directory

Wireshark packet capture file format