Background
Cisco IOS Embedded Packet Capture (EPC) is an extremely useful troubleshooting tool and can prove particularly helpful when it is not feasible to set up a network tap or when diagnosing a problem on a remote system.
My lab device is a ASA5505, however the capture commands are similar across most platforms. (ASA, PIX, FWSM and ISR routers running IOS 12.4(20)T or later)
Capturing Traffic on the ASA
The basic syntax of the capture command is as follows:
capture <capture name> interface <interface name>
While the capture is running, you can view the results on the console (not always a good idea and not very easy to read) or in a web browser.
To view the capture in a browser, format the URL as follows:
https://<device ip address>/admin/capture/<capture name>
A better option would be to open the capture in Wireshark. We can download the capture in libpcap format by specifying the /pcap option at the end of the URL.
https://<device ip address>/admin/capture/<capture name>/pcap
When prompted, select the “Open With” radio button and select Wireshark from the list. (you’ll need to have Wireshark installed on your host)
To stop the capture, simply negate the capture command, followed by the capture name. This also removes the capture from the buffer so make sure you export it using the above procedure if you want to save the results:
no capture <capture name>
Options
Besides the many filtering options, it’s possible to specify multiple simultaneous captures, each with different criteria. Let’s capture only IP traffic on the outside interface and ARP traffic on the inside interface.
If you lose track of what captures are running on the device, enter show capture at the prompt to display active captures and their options.
Conclusions
EPC is a useful feature and has numerous capabilities beyond what I’ve demonstrated here. When combined with Wireshark, EPC provides the ability to quickly capture and analyze network traffic without a tap or mirroring a port on an adjacent switch.
Additional Reading
ASA/PIX/FWSM: Packet Capturing using CLI and ASDM Configuration Example
