CCIEv5 EPC Overview By CCSI: Yasser Auda

1

Embedded Packet Capture (EPC) is a packet capture tool capture packets flowing to, through, and from
the device then we can analyze them locally or save as packet capture (PCAP) file and export it for
offline analysis by using a tool such as Wireshark.

This tool is configured in exec mode , packets captured are stored within a buffer in DRAM , As a result
the tool configuration is not stored within the router configuration and will not remain in place after a
system reload. (Your EPC configurations are kept temporary in the router )

To configure EPC you to define two things and gives them a names: buffer point & capture point then
attach the buffer point to your capture point .

Buffer Point: Define temporary buffer in your DRAM that the captured packets are stored within.

Capture Point: Define defines the location where the capture occurs. also defines whether the capture
occurs for IPv4 or IPv6 and in which switching path (process versus cef).

Notes from Cisco TAC:
In releases earlier than Cisco IOS Release 15.0(1)M, the buffer size was limited to 512K.
In releases earlier than Cisco IOS Release 15.0(1)M, the captured packet size was limited to 1024 bytes.
The packet buffer is stored in DRAM and will not persist through reloads.
The capture configuration is not stored in NVRAM and will not persist through reloads.
The capture point can be defined to capture in the cef or process switching paths.
The capture point can be defined to capture only on an interface or globally.
When the capture buffer is exported in PCAP format, L2 information (such as Ethernet encapsulation) is
not preserved

Two types of data are stored in a capture buffer: Meta Data and Packet Data.
Meta Data (which helps in filtering too) contains:
A timestamp of when it is added to a buffer.
Direction, egress or ingress.
The switch path it captured.
Encapsulation type corresponding to input/output interface to allow the decoding of L2.
Offset to network start, to facilitate the decoding of L3, if complete L2 decoders are unavailable.
L3 protocol ID, to facilitate the decoding of L3, if complete L2 decoders are unavailable.














CCIEv5 EPC Overview By CCSI: Yasser Auda

2

Configuring EPC commands

1-Create buffer point:
R1#monitor capture buffer MYBUFFER size 512 max-size 1024 linear
size is the size of this buffer in KB
Max-size is number of bytes to capture per packet & can be limited to save space
linear or circular is type of buffer:
A linear buffer will stop capturing automatically when full.
A circular buffer will continue to capture packet data (overwriting old data with newer as it fills.

Optionally we can enable rate limit to
Specify a max capture rate (in packets per second).
Capture every "nth" packet.
Or automatic limit criteria can be defined to:
Stop the capture after a specified time interval.
Stop the capture after capturing a given number of packets.

R1#monitor capture buffer MYBUFFER limit?
allow-nth-pak Allow every nth packet through
duration Duration of capture
packet-count Limit total Number of packets captured
packets-per-sec Limit number of packets copied per sec

Optionally a filter can also be applied to limit the capture to desired traffic. Define an Access Control
List (ACL) within config mode and apply the filter to the buffer:
ip access-list extended BUF-FILTER
permit ip host 192.168.1.1 host 172.16.1.1
permit ip host 172.16.1.1 host 192.168.1.1
R1#monitor capture buffer MYBUFFER filter access-list BUF-FILTER

2-Create capture point:
We define four things in capture point , protocols IPv4 or IPv6 Traffic , Forwarding method CEF or
process switching , which interface and which traffic Direction under this interface :
In (meaning capture at ingress)
Out (meaning capture at egress)
Both
R1#monitor capture point ip process-switched MYPOINT

3- Associate or attach your buffer point to your capture point
R1#monitor capture point associate MYPOINT MYBUFFER

We can associate more than one capture points to single capture buffer
For example we can create one capture point for OSPF traffic and one for BGP traffic (ACL will help you
to do that)

Verification:
R1#sh monitor capture point all
R1#sh monitor capture buffer all parameters
CCIEv5 EPC Overview By CCSI: Yasser Auda

3

4-Start & Stop capturing traffic
R1#monitor capture point start MYPOINT
R1#monitor capture point stop MYPOINT

5-To view what you captured locally
Show monitor capture buffer MYBUFFER dump

6-To save what you captured as pcap file and export to analyze with wireshark
Monitor capture buffer MYBUFFER export tftp://10.1.1.1/capture.pcap

EPC Lab


R1 & R4 running OSPF process id 100 , area 0
R1 s1/0 10.1.14.1/24 loop 0 1.1.1.1/32
R4 s1/0 10.1.14.4/24 loop 0 4.4.4.4/32

1-Create space called MYBUFFER in your R1 volatile memory to store packets captured .with following
requirements:
-volatile memory space size is 1024KB
-max packet size to capture 1024KB
-volatile memory space must continue to capture packets even if buffer full.
-capturing data should remain for 15 minutes duration.
Create general ACL to be used later by network administrator in case he would like to capture
specific type of protocols or ports.

2- You will capture CEF -IPv4 packets ingress or egress interface serial 1/0 (capture point name will be
MYPOINT) and associate it to your buffer point.
3- Start capturing data and ping 4.4.4.4, all you captured data must be saved as Yasser.pcap then
exported to tftp server 10.1.15.5
CCIEv5 EPC Overview By CCSI: Yasser Auda

4

Answer:
1-
R1(config)#ip access-list ext 101
R1(config-ext-nacl)#permit ospf any any
R1(config-ext-nacl)#exit
R1(config)#exit

R1#monitor capture buffer MYBUFFER size 1024 max-size 1024 circular
R1#monitor capture buffer MYBUFFER limit duration 900
R1#monitor capture buffer MYBUFFER filter access-list 101

2-
R1#monitor capture point ip cef MYPOINT serial 1/0 both
R1#monitor capture point associate MYPOINT MYBUFFER



3-
R1#monitor capture point start MYPOINT
R1#ping 4.4.4.4
R1#monitor capture point stop MYPOINT

R1#monitor capture buffer MYBUFFER export tftp://10.1.14.4/yasser.pcap

CCIEv5 EPC Overview By CCSI: Yasser Auda

5




Good Luck
CCSI: Yasser Auda
https://www.facebook.com/YasserRamzyAuda
https://learningnetwork.cisco.com/people/yasser.r.a?view=documents
https://www.youtube.com/user/yasserramzyauda