Configuring the capture is done with the following steps:
1.Create the buffer
2.Create the capture point
3.Associate the capture point to the buffer
4.Start the capture point
1) Create the buffer:
R4#monitor capture buffer BUFFER1 max-size 9500
2) Create the capture point:
R4#monitor capture point ip cef CEF-ALL_INTERFACES all both
3) Associate the capture point to the buffer. The packets captured will be stored:
R4#monitor capture point associate CEF-ALL_INTERFACES BUFFER1
4) Start the capture:
R4#monitor capture point start CEF-ALL_INTERFACES
How to Monitor and Export:
R4#show monitor capture buffer BUFFER1 parameters Capture buffer BUFFER1 (linear buffer) Buffer Size : 1048576 bytes, Max Element Size : 9500 bytes, Packets : 125 <--if this number is 0, then you aren't capturing for some reason. Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0 Associated Capture Points: Name : CEF-ALL_INTERFACES, Status : Active Configuration: monitor capture buffer BUFFER1 max-size 9500 monitor capture point associate CEF-ALL_INTERFACES BUFFER1
EXPORT:
Stop Capture
R4#monitor capture point stop CEF-ALL_INTERFACES
Start Exporting Capture File to TFTP
R4#monitor capture buffer BUFFER1 export TFTP://172.16.123.254/example.pcap
Note:
This is direcly repost from