Create Packet Capture on Cisco Router

R1#

// Verify interfaces
sh ip int br | e ass

monitor capture buffer MYBUFFER size 512 max-size 128 linear

// Display buffer output
sho mon cap buffer MYBUFFER parameters

{
Associated Capture Points:
Configuration:
}

//Need to associate capture points.

monitor capture point ip cef Gi1_01 gi1/0/1 both

sho mon cap point all

{
IPV4 CEF
Switch Path: IPV4 CEF
Status: Inactive //Will change to active when a packet capture is started

Configuration:

//Start capture
//Start TFTP server
monitor capture point associate Gi1_01 MYBUFFER  export tftp://RFC 1914 ip address
{
%Export failed
}
monitor capture point associate Gi1_01 MYBUFFER  export tftp://%RFC 1914 ip address/%FILENAME.pcap

//look at TFTP server to verify

//Open capture in WireShark