Embedded Packet Capture (EPC)

References:
https://supportforums.cisco.com/document/11990836/packet-capture-using-epc-embedded-packet-capture
http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-embedded-packet-capture/datasheet_c78-502727.html

 

This works on IOS-XE devices such as the ASR920 for example:

This once worked with IOS-XE on ASR920s but doesn't seem to work in recent versions of IOS-XE and on the Cisco Feature Explorer it is listed as unsupported for ASR920s. In the early days of the ASR920 (when this was tested) many IOS-XE commands were present that didn't work, like PPPoE subscriber termination, which now work on the ASR920. This feature seems to have transitioned from working to not working/not supported.

monitor capture buffer cb size 102400 max-size 9500

monitor capture point ip process-switched cp both
or
monitor capture point ip cef cp gi0/1 both

monitor capture point associate cp cb

monitor capture point start cp

show monitor capture point all

show monitor capture buffer all parameters

monitor capture point stop cp

show monitor capture buffer cb dump

monitor capture buffer cb export flash0:test-dump.pcap

 

This works on the ASR1000s (non-X models):

monitor capture cp interface gi0/0/1 in match any buffer size 10

ASR1K1#show monitor capture cp parameter
monitor capture cp interface GigabitEthernet0/0/1 in
monitor capture cp match any
monitor capture cp buffer size 10

ASR1K1#show monitor capture cp

Status Information for Capture cp
  Target Type:
   Interface: GigabitEthernet0/0/1, Direction: in
   Status : Inactive
  Filter Details:
    Capture all packets
  Buffer Details:
   Buffer Type: LINEAR (default)
   Buffer Size (in MB): 10
  Limit Details:
   Number of Packets to capture: 0 (no limit)
   Packet Capture duration: 0 (no limit)
   Packet Size to capture: 0 (no limit)
   Packet sampling rate: 0 (no sampling)

ASR1K1#monitor capture cp start
*Dec  9 2016 03:08:30.078 UTC: %BUFCAP-6-ENABLE: Capture Point cp enabled.

ASR1K1#show monitor capture cp

Status Information for Capture cp
  Target Type:
   Interface: GigabitEthernet0/0/1, Direction: in
   Status : Active
  Filter Details:
    Capture all packets
  Buffer Details:
   Buffer Type: LINEAR (default)
   Buffer Size (in MB): 10
  Limit Details:
   Number of Packets to capture: 0 (no limit)
   Packet Capture duration: 0 (no limit)
   Packet Size to capture: 0 (no limit)
   Maximum number of packets to capture per second: 1000
   Packet sampling rate: 0 (no sampling)

ASR1K1#show monitor capture cp buffer
 buffer size (KB) : 10240
 buffer used (KB) : 0
 packets in buf   : 0
 packets dropped  : 0
 packets per sec  : 0

#monitor capture cp stop

#show monitor capture cp buffer dump

#monitor capture cp export flash:capture.pcap

---