Cisco IOS
PCAP Generator
Generate Cisco IOS-XE packet capture commands with filter, buffer, export options, and Wireshark guide
Traffic Filter
conf t
!
! === PACKET CAPTURE: CAP1 ===
!
! 1. Define capture on interface
monitor capture CAP1 interface GigabitEthernet0/0 both
monitor capture CAP1 match any
!
! 2. Set buffer size
monitor capture CAP1 buffer size 10
!
! 3. Start capturing
monitor capture CAP1 start
!
! --- Let traffic flow, then stop when done ---
!
! 4. Stop capture
monitor capture CAP1 stop
!
! 5. Verify captured packets
show monitor capture CAP1
show monitor capture CAP1 buffer brief
!
! 6. Export capture file
monitor capture CAP1 export flash:cap1.pcap
!
! Then transfer to workstation:
! copy flash:cap1.pcap tftp://192.168.1.100/cap1.pcap
!
! 7. Clean up
no monitor capture CAP1
What is a PCAP?
A .pcap file is a packet capture — a recording of raw network frames flowing
across an interface. The format was developed for libpcap / tcpdump on Linux/Unix
and is now universal. Any tool that captures packets — Wireshark, tcpdump, Cisco EPC — can write
and read .pcap files.
A pcap is the file format.
tcpdump and Cisco EPC are different tools that both produce pcap files. They are not the same thing, but their output is interchangeable
in Wireshark.
Cisco EPC vs tcpdump
| Feature | Cisco EPC (monitor capture) | tcpdump |
|---|---|---|
| Runs on | IOS-XE, IOS (EPC) | Linux shell (NX-OS bash, NFVIS, SD-WAN vEdge) |
| Output format | .pcap (via export command) | .pcap (via -w flag) |
| CLI interface | Standard IOS CLI | Linux terminal / bash shell |
| Real-time decode | show monitor capture NAME buffer detailed | Yes — live in terminal output |
| Export to Wireshark | TFTP, FTP, flash, USB | Copy the .pcap file off the device |
| Filtering | IOS ACL syntax (no BPF) | Full BPF filter syntax |
| Requires Linux shell | No | Yes |
Platform Support
| Platform | Capture Method | Notes |
|---|---|---|
| IOS-XE | monitor capture | Full EPC — use the generator on this page |
| Classic IOS | monitor capture (EPC) | Older syntax; buffer-only on some versions |
| NX-OS (Nexus) | ethanalyzer / tcpdump | ethanalyzer for control-plane; tcpdump in bash for data-plane |
| IOS XR | monitor-session / tcpdump | Uses SPAN/ERSPAN or tcpdump in admin shell |
| SD-WAN vEdge | tcpdump (Linux shell) | request shell — writes pcap natively |
| Firepower / FTD | capture (LINA) / tcpdump | LINA (ASA) capture cmd, or tcpdump on FTD CLI |
| ASA | capture NAME interface INTF | Different syntax — download via ASDM or HTTPS |
Key IOS-XE EPC Commands
| Command | Purpose |
|---|---|
| monitor capture NAME interface INTF both | Define capture on interface (both directions) |
| monitor capture NAME match any | Capture all traffic — no filter |
| monitor capture NAME match ipv4 any any | Capture all IPv4 traffic |
| monitor capture NAME match ipv4 access-list ACL | Filter capture using an extended ACL |
| monitor capture NAME buffer size <MB> | Set buffer size (default is only 1 MB!) |
| monitor capture NAME buffer circular | Overwrite oldest packets when buffer is full |
| monitor capture NAME start | Begin capturing traffic |
| monitor capture NAME stop | Stop the capture |
| show monitor capture NAME | Check capture status and packet count |
| show monitor capture NAME buffer brief | Quick summary of captured packets in CLI |
| show monitor capture NAME buffer detailed | Full hex/decode of packets in CLI |
| monitor capture NAME export flash:file.pcap | Export buffer to flash as .pcap |
| monitor capture NAME export tftp://IP/file.pcap | Export directly to TFTP server |
| no monitor capture NAME | Delete the capture and free the buffer |
Exporting from IOS-XE
Stop the capture first, then export the buffer to a file you can retrieve.
| Method | Command | Notes |
|---|---|---|
| Flash | monitor capture CAP1 export flash:cap1.pcap | Store on router flash, then SCP/TFTP off |
| bootflash | monitor capture CAP1 export bootflash:cap1.pcap | ISR/ASR platform name for flash |
| TFTP | monitor capture CAP1 export tftp://10.0.0.1/cap1.pcap | Fastest — sends directly to TFTP server |
| FTP | monitor capture CAP1 export ftp://user:pass@10.0.0.1/cap1.pcap | Use where TFTP is unavailable |
| USB | monitor capture CAP1 export usb0:cap1.pcap | If USB storage is installed on the device |
After exporting to flash: Use
copy flash:cap1.pcap tftp://<server>/cap1.pcap or SCP to pull the file to your workstation.
Buffer size warning: The default buffer is only 1 MB.
Always set a larger buffer with
monitor capture NAME buffer size <MB> before
starting, or use monitor capture NAME buffer circular to prevent drops when the buffer
fills.
Opening in Wireshark
-
Transfer the
.pcapfile to your workstation via SCP, TFTP, or ASDM/HTTPS. -
Open Wireshark → File → Open → select the
.pcapfile. - Use the Display Filter bar to narrow down traffic (see common filters below).
- Right-click any packet → Follow → TCP Stream to reconstruct full sessions.
- Use Statistics → Protocol Hierarchy for a protocol breakdown of the capture.
- Use Statistics → Conversations to identify top-talker IP pairs.
- Use Statistics → IO Graph to visualize traffic rate over time.
Download Wireshark (free):
wireshark.org/download.html — available for Windows, macOS, and Linux.
Common Wireshark Display Filters
| Display Filter | What it shows |
|---|---|
| ip.addr == 192.168.1.1 | All traffic to or from a specific IP |
| ip.src == 10.0.0.0/8 | Traffic sourced from a subnet |
| ip.dst == 8.8.8.8 | Traffic destined to a specific IP |
| tcp.port == 443 | HTTPS traffic (either direction) |
| udp.port == 5060 | SIP / VoIP signaling |
| icmp | All ICMP (ping, traceroute, unreachable) |
| ospf | OSPF hellos and LSA packets |
| stp | Spanning Tree Protocol BPDUs |
| tcp.flags.syn==1 && tcp.flags.ack==0 | TCP SYN — new connection attempts |
| tcp.flags.reset==1 | TCP RST — rejected or broken connections |
| !arp && !stp && !cdp | Hide noisy control-plane traffic |
| frame.len > 1400 | Large frames — watch for fragmentation |
| dns | All DNS queries and responses |
| http.request | HTTP GET / POST requests only |
| ip.addr==192.168.1.1 && tcp.port==22 | SSH traffic to/from a specific host |
| udp.port==161 || udp.port==162 | SNMP queries and traps |