Skip to content
Log in Sign up My account

Packet Analyzers and Capture

This article covers the practical side of packet capture for network engineers: the difference between Wireshark capture and display filters, tshark and tcpdump one-liners, Embedded Packet Capture on IOS XE, getting traffic to a capture box with SPAN and ERSPAN, and a few Wireshark profile settings that save time. Everything here is aimed at answering "what is actually on the wire" quickly and with the least risk to production.

Try PCAP Analyzer

PCAP Analyzer, from the same author as this site, takes captures from one or more points in the network and returns a ranked, evidence-backed diagnosis, with a Wireshark filter and frame numbers for every finding. A free cisconets.com account includes 7 days of read-only demo access.

Choose where to capture

The best capture point is as close to the problem as you can get without disturbing it.

graph TB
    A["Capture on the endpoint<br/>(tcpdump, Wireshark)"] --> Z["Easy, sees host view only"]
    B["Capture on the device<br/>(Embedded Packet Capture)"] --> Y["No extra gear, limited by CPU and buffer"]
    C["SPAN to a local capture port"] --> X["Complete copy, same switch"]
    D["ERSPAN over IP to a remote box"] --> W["Remote capture, adds GRE encapsulation"]
    E["Network TAP"] --> V["Most accurate, needs hardware"]

Rules of thumb:

  • If you control the endpoint, capture there first. It is the least invasive option.
  • If the problem is between two devices, capture on the device with EPC or via SPAN.
  • Use a TAP when you need an exact copy including errors, or must not alter forwarding at all.
  • Always know which direction and which VLAN you are capturing, and whether the capture point sees the packet before or after NAT, encryption or tagging.

Capture filters versus display filters

Wireshark has two filter languages, and mixing them up is the most common beginner error.

Capture filter Display filter
When applied Before packets are saved After capture, on what you see
Syntax BPF (the same as tcpdump) Wireshark's own field syntax
Can you undo it No, dropped packets are gone Yes, change at any time
Example host 10.1.1.1 and tcp port 179 ip.addr == 10.1.1.1 && tcp.port == 179
Use it to Limit volume on busy links Analyze

Use a capture filter when volume or disk space is the problem, or when privacy matters. Otherwise capture broadly and filter on display, because you often find the real clue in packets you did not expect.

Capture filter examples (BPF)

host 192.0.2.10
net 10.20.0.0/16
tcp port 179
udp port 161 or udp port 162
not port 22
vlan and host 10.1.1.1
ether proto 0x88cc

The last one matches LLDP frames. In BPF, the vlan keyword shifts how later primitives are matched, so test a VLAN filter on a known flow before you trust it.

Display filter examples

ip.addr == 192.0.2.10
tcp.flags.syn == 1 && tcp.flags.ack == 0
tcp.analysis.retransmission
tcp.analysis.zero_window
dns.flags.rcode != 0
bgp || ospf
bgp.type == 3
vlan.id == 100
lldp || cdp
stp
icmp.type == 3
dhcp
tls.handshake.type == 1
frame.time_delta_displayed > 1

A few notes:

  • ip.addr == x matches source or destination. Use ip.src or ip.dst to be specific, and != carefully: ip.addr != x is not what most people mean, so write !(ip.addr == x).
  • tcp.analysis.* fields come from Wireshark's TCP analysis; they flag retransmissions, duplicate ACKs, lost segments and zero windows. They are excellent for deciding whether a slow application is a network or a host problem.
  • bgp.type == 3 is a NOTIFICATION message, the first thing to look at for a session that keeps dropping.

tshark: Wireshark on the command line

tshark ships with Wireshark and uses the same dissectors and filters, which makes it ideal for servers with no GUI and for scripting.

# List interfaces
tshark -D

# Capture 60 seconds on eth0 with a capture filter, write to file
tshark -i eth0 -f "port 179" -a duration:60 -w bgp.pcapng

# Read a file, apply a display filter, print selected fields
tshark -r bgp.pcapng -Y "bgp.type == 3" \
  -T fields -e frame.time -e ip.src -e ip.dst -e bgp.notify.major_error

# DNS queries and response codes
tshark -r dns.pcapng -Y "dns" -T fields -e ip.src -e dns.qry.name -e dns.flags.rcode

# Conversation statistics, no packet output
tshark -r capture.pcapng -q -z conv,tcp

# Packets per second summary
tshark -r capture.pcapng -q -z io,stat,1

-f is a capture filter and -Y is a display filter; they are different flags on purpose. To list available fields for a protocol, run tshark -G fields | grep '^F.*bgp'.

tcpdump one-liners

tcpdump is on almost every Linux box and many network operating systems. Use -nn to stop DNS and port name lookups, which slow output and confuse results.

# Basic: IP traffic to or from a host, no name resolution
tcpdump -nn -i eth0 host 192.0.2.10

# Write to file, full packets, for Wireshark later
tcpdump -nn -i eth0 -s 0 -w /tmp/cap.pcap 'tcp port 443 and host 192.0.2.10'

# Rotate files: 100 MB each, keep 10
tcpdump -nn -i eth0 -C 100 -W 10 -w /tmp/ring.pcap

# New file every 5 minutes with timestamped names
tcpdump -nn -i eth0 -G 300 -w '/tmp/cap_%Y%m%d_%H%M%S.pcap'

# Show link-layer headers and VLAN tags
tcpdump -nn -e -i eth0 vlan

# SNMP traffic
tcpdump -nn -i eth0 'udp port 161 or udp port 162'

# New TCP connections only (SYN without ACK)
tcpdump -nn -i eth0 'tcp[tcpflags] & (tcp-syn|tcp-ack) == tcp-syn'

# LLDP and CDP frames
tcpdump -nn -v -i eth0 ether proto 0x88cc
tcpdump -nn -v -i eth0 ether dst 01:00:0c:cc:cc:cc

# DHCP
tcpdump -nn -v -i eth0 'udp port 67 or udp port 68'

# GRE (including ERSPAN)
tcpdump -nn -i eth0 ip proto 47

# Read a file
tcpdump -nn -r /tmp/cap.pcap 'host 192.0.2.10'

Notes: on modern versions the default snap length already captures whole packets, but -s 0 is harmless and explicit. Capturing needs root or the right capabilities. Always write to a file on a volume with enough space, or you may fill the root disk during an incident.

Embedded Packet Capture on IOS XE

Embedded Packet Capture (EPC) lets a device capture packets itself, with no extra gear. It is limited by CPU, memory buffer and the platform, so use filters and short durations. Syntax differs between platform families, so confirm against the guide for your model and release. The shape on a Catalyst 9000 series switch is:

monitor capture CAP interface GigabitEthernet1/0/1 both
monitor capture CAP match ipv4 host 192.0.2.10 any
monitor capture CAP buffer size 10
monitor capture CAP limit duration 60
monitor capture CAP start

show monitor capture CAP
show monitor capture CAP buffer brief

monitor capture CAP stop
monitor capture CAP export flash:cap.pcap
no monitor capture CAP

You can use match any for an unfiltered capture (not recommended on a busy port). On routers (ISR, ASR, Catalyst 8000) EPC commonly uses an access list to select traffic:

ip access-list extended EPC-ACL
 permit ip host 192.0.2.10 any
 permit ip any host 192.0.2.10
!
monitor capture CAP access-list EPC-ACL interface GigabitEthernet0/0/0 both
monitor capture CAP buffer size 10 circular
monitor capture CAP start

Copy the file off the box with copy flash:cap.pcap scp://[email protected]/ or TFTP, then open it in Wireshark.

Warning

EPC competes with forwarding for resources on some platforms. Start with a narrow filter, a small buffer and a short time limit, and confirm CPU with show processes cpu sorted while it runs. Also remember that a capture can contain credentials and other sensitive data. Treat the pcap file as sensitive.

SPAN and ERSPAN to a capture box

When you need a full copy of traffic, mirror it to another port or across the network.

Local SPAN copies traffic from source interfaces or VLANs to a destination port on the same switch:

monitor session 1 source interface GigabitEthernet1/0/1 both
monitor session 1 destination interface GigabitEthernet1/0/48
show monitor session 1

ERSPAN wraps mirrored packets in GRE so they can cross a routed network to a remote capture host. The classic Type II uses GRE protocol type 0x88BE and Type III uses 0x22EB; Wireshark decodes both. A Catalyst 9000 source session looks like this (check platform support, since ERSPAN is not available on all models and releases):

monitor session 10 type erspan-source
 source interface GigabitEthernet1/0/1 both
 destination
  erspan-id 10
  ip address 192.0.2.50
  origin ip address 192.0.2.1

The destination is the capture box's IP address. The box needs a reachable address on that network, and it receives GRE packets that Wireshark can open directly.

Capture box checklist

  1. Use a dedicated NIC for the mirrored traffic, with no IP address on a SPAN-destination port, so it only listens.
  2. Put the interface in promiscuous mode and disable offloads that distort captures:
ip link set eth1 promisc on
ethtool -K eth1 gro off lro off tso off gso off
  1. Send the captured stream to a file with rotation, as in the tcpdump examples above.
  2. Check the NIC and disk can keep up. Dropped packets in the capture mean missing evidence; tcpdump reports "packets dropped by kernel" on exit.
  3. Check that the SPAN session is not oversubscribed. If the destination port is slower than the combined source traffic, the switch will drop mirrored frames silently.
  4. Be aware that SPAN copies do not always preserve exact timing, and some frames (for example those with errors, or certain control frames) may not be mirrored.

Useful Wireshark profiles

Profiles (Edit, Configuration Profiles) let you switch whole setups of columns, colouring rules and filter buttons. Make a few and keep them in Git so they travel with you. Profiles live in your Wireshark personal configuration folder, so copying the profile directory moves them.

Troubleshooting profile

  • Columns: No., Time (set time display to "seconds since previous displayed packet" using View, Time Display Format), Source, Destination, Protocol, Length, Info.
  • Add custom columns for tcp.stream, vlan.id, ip.dsfield.dscp and ip.ttl.
  • Turn off name resolution so addresses stay as addresses (Preferences, Name Resolution).
  • Filter buttons: SYN only, retransmissions, zero window, DNS errors.

Routing profile

  • Filter buttons for bgp.type == 3, ospf.msg.hello, ospf.msg.dbdesc, isis, bfd.
  • Custom columns for ospf.area_id and bgp.update.path_attribute.as_path.

VoIP and QoS profile

  • Columns for ip.dsfield.dscp, rtp.ssrc and rtp.seq.
  • Use Telephony, RTP and VoIP Calls menus to analyze jitter and loss.

Layer 2 profile

  • Filters for stp, lldp || cdp, lacp, vlan and arp.
  • Colouring rules that highlight STP topology changes and gratuitous ARP.

Time display format matters more than any other setting. "Seconds since beginning of capture" is good for overall timelines, and "since previous displayed packet" is good for finding delays inside a flow when combined with a display filter.

Tip

Save a decode-as rule in your profile for non-standard ports. Right-click a packet, choose Decode As, and set the port to the right protocol. Without it, Wireshark will show your BGP or HTTP-on-8080 traffic as raw TCP.

A short method

  1. State the question: which flow, which two hosts, which time.
  2. Pick the capture point and the narrowest safe capture filter.
  3. Capture while reproducing the problem, and note the exact time of the failure.
  4. Check the top-level view first: Statistics, Conversations, and Expert Information.
  5. Follow the stream and compare the two ends. Packets that leave one side and never arrive at the other point to the path between them.
  6. Save the pcap with a descriptive name, and delete it when the case is closed.

For a practice setup to capture against, see the CCNP course lab setup guide.

References