Cisco Embedded Packet Capture (EPC) – Explanation & Configuration

Troubleshooting network performance can sometimes be challenging, especially if the problem being faced is intermittent, or if it results in the degradation of network performance. 

There is a whole arsenal of tools out there that can help in diagnosing and resolving such network issues. 

Cisco IOS and IOS-XE devices have an embedded feature that allows you to capture and inspect packets flowing through the network device, aiding you in your troubleshooting process.  This feature is known as Cisco Embedded Packet Capture (EPC).

In this article, we’ll take a closer look at this feature, giving you a head start in using it and learning about all of its capabilities for your network troubleshooting endeavors.

What is packet capture?

Packet capturing tools are used to read and store individual network packets in such a way so that they can be viewed and examined by a network technician. 

The contents of the packets at each layer of the OSI model can provide a wealth of information about the way in which data is transmitted over the network infrastructure, thus aiding in the troubleshooting process. 

Streams of captured packets are typically saved within a packet capture or PCAP file, which is a standardized way of storing captured packets for later analysis or for sharing with other network professionals.  A very popular and powerful packet capture and analysis tool is Wireshark.

Introducing EPC

In order to capture packets, tools like Wireshark require a computer running the software, as well as a specialized configuration of the network device to redirect a copy of particular packets to the computer for capturing.  Although not too difficult to set up, network administrators often require a more direct, “quick and dirty” method of capturing packets.

For this reason, Cisco developed EPC.  EPC is a feature that can capture network packets flowing through a Cisco router or switch directly, using the device itself without needing external packet-capturing tools.

Captured packets are stored directly in DRAM of the device and can later be exported to the PCAP format.  This capability is particularly useful for diagnosing network issues, monitoring traffic, and ensuring network security compliance.

EPC is a command-line-based application that runs right on the Cisco device itself. 

Basic EPC packet capture process

To configure EPC to operate on a device, you must first configure and define the following parameters:

• Define a “capture buffer”, which is a temporary buffer where the captured packets are stored.
• Apply a filter (optional). You can filter which packets will be captured using Access Lists.  This way you can capture only the types of packets you’re interested in, making the resulting packet capture file easier to work with, while saving system memory at the same time.
• Define a capture point and direction of capture. This is the interface on which the capture occurs, and the direction of packet flow you want to capture.  You can capture ingress, egress, or both.
• Attach the buffer to the capture point.

Once all of the above are complete, the only thing left is to enable the capture, allow some traffic to traverse the capture point, and then disable the capture.  If packets traversed the capture point during the capture, those packets are stored within the buffer on DRAM.

You should typically perform some action on an application to ensure that the desired traffic is generated across the capture point (like a ping, a VoIP phone call, or a file transfer, for example) during the capture process, otherwise, you may not capture any packets at all.

EPC packet capture example

The following is an example of how EPC would be configured and applied on a Cisco router.  All commands begin with the monitor capture keywords in global configuration mode.

Define a capture buffer. 

The command monitor capture buffer is used to create a capture buffer and define its various parameters.  The following command creates a capture buffer called My_Buffer on R1. 

R1#monitor capture buffer My_Buffer

But this command is incomplete.  We can add some more parameters to specify exactly what we want.  Take a look at this context sensitive help that shows us some of these:

R1#monitor capture buffer My_Buffer ?

  circular  Circular Buffer
  clear     Clear contents of capture buffer
  export    Export in Pcap format
  filter    Configure filters
  limit     Limit the packets dumped to the buffer
  linear    Linear Buffer(Default)
  max-size  Maximum size of element in the buffer (in bytes)
  size      Packet Dump buffer size (in Kbytes)

Let’s create a buffer, named My_Buffer, with a packet dump file size of 10000 Kbytes, with a circular buffer.  A circular buffer will overwrite previously saved packets if the packet dump file size is exceeded.

R1#monitor capture buffer My_Buffer size 10000 circular

Apply a Filter

You can optionally apply a filter to the EPC packet capture process to capture only the packets that you want. 

For example, you may only want to capture packets from one particular host to another.  Or you may want to specify packets that use a particular TCP or UDP port.  In any case, once you define an ACL to match the type of packets you want to capture, you can apply it to the EPC like so:

R1#monitor capture buffer My_Buffer filter access-list My_Filter

…where My_Filter is the name of the ACL you have created.

Configuring a Capture Point

To define a capture point, you use the monitor capture point command.  To do so, we must specify the version of IP that is being used.  Let’s specify IPv4.  When we do so, we are given additional options:

R1#monitor capture point ip ?

  cef               IPv4 CEF
  process-switched  Process switched packets

Without going into details about these options, Cisco Express Forwarding (CEF) is enabled on Cisco devices by default, so let’s choose that. 

Next, let’s define the name of our capture point (let’s call it My_Point), and choose the GigabitEthernet 0/1 interface as that capture point. 

In the following context sensitive help, we can see that we can configure the capture either inward, outward, or in both directions:

R1#monitor capture point ip cef My_Point GigabitEthernet 0/1 ?

  both  capture ingress and egress
  in    capture on ingress
  out   capture on egress

Let’s choose both:

R1#monitor capture point ip cef My_Point GigabitEthernet 0/1 both
%BUFCAP-6-CREATE: Capture Point My_Point created.

Associate capture point and buffer

The following command associates the capture point My_Point with our buffer My_Buffer:

R1#monitor capture point associate My_Point My_Buffer

Start and stop capture

To start and stop the capture process, use the following commands:

R1#monitor capture point start My_Point

%BUFCAP-6-ENABLE: Capture Point My_Point enabled.

At this point, the device is capturing packets.  To stop the capture, use the following command:

R1#monitor capture point stop My_Point

%BUFCAP-6-DISABLE: Capture Point My_Point disabled.

Viewing results

During and after capturing, you can use the show monitor capture buffer command to view the captured packets and various other information:

• show monitor capture buffer [buffer_name] – Shows you a list of packets that were captured, including date, time, and interface.
• show monitor capture buffer [buffer_name] dump – Displays the contents of every captured packet in hexadecimal.
• show monitor capture buffer [buffer_name] parameters – Displays the configured parameters of the buffer as well as the current number of packets that have been captured.

Outputting to a PCAP file

Although you can view the packet in the CLI, it is almost always easier to view the captured files in a packet analysis program like Wireshark.  You can output the captured packets in a PCAP file using the following command:

R1#monitor capture buffer My_Buffer export ?

  flash:  Location to dump buffer
  ftp:    Location to dump buffer
  http:   Location to dump buffer
  https:  Location to dump buffer
  pram:   Location to dump buffer
  rcp:    Location to dump buffer
  scp:    Location to dump buffer
  tftp:   Location to dump buffer

You can see that there are various options to transfer the file to an external device using any one of a series of protocols.

Conclusion

This is just an introduction to get you started using EPC.  You can find out more information at this Cisco EPC configuration guide.  With it, and with some practice in a controlled lab environment, you can become proficient in capturing, exporting, and analyzing captured packets.

The Embedded Packet Capture feature provides useful functionalities, allowing network administrators to easily and directly capture packets traversing a network device, with little hassle. 

With several powerful options, it is particularly advantageous in complex network environments where quick diagnostics and troubleshooting are needed without impacting network performance.