Packet capture from IOU

Packet capturing from a regular router works great, but how to get a readable packet capture from IOU if you don’t want to deal with all the UNIX crap?

Here is a little tutorial on that:

=== 1-6 Copied directly from http://www.cciezone.com/?p=107 ===

  1. Define an ACL which specifies which traffic should be captured
  2. Create the capture buffer and set .pcap export location
    #monitor capture buffer CAPTURE
    #monitor capture buffer CAPTURE export unix:/capture.pcap
  3. Create the capture point
    #monitor capture point ip process-switched CAPTURE both
  4. Associate the capture point with the capture buffer
    #monitor capture point associate CAPTURE CAPTURE
  5. Start the capture point
    #monitor capture point start CAPTURE
    …Let traffic pass through the router…
  6. Stop the capture point
    #monitor capture point stop CAPTURE

== Get it from IOU to Wireshark ===

  1. Set terminal length to 0, so output doesn’t break with –more–
    #terminal length 0
  2. In SecureCRT, go to Transfer > Receive ASCII and set file save location.
  3. Receive the entire file
    #more unix:/capture.pcap
  4. In SecureCRT, uncheck Receive ASCII to stop the download.
  5. Use Notepad++ to join all the lines (Edit>Line Operations>Join Lines), then do a replace all on spaces with nothing to remove any spaces.
  6. Save file and open in WireShark!

Happy capturing!

2 Responses to Packet capture from IOU

  1. Pablo says:

    Hi Sr

    I want to build my virtual CCIE home Lab

    which is the best way to do it? I could give some advice on how to emulate the switches?.

    Thanks

Leave a comment