wireshark capture filter for subnet range

Please be aware of typical CPU & memory usage before enabling these features. Wireshark on IOS XE is also a method of capturing and displaying traffic in IOS XE, however, Wireshark is much more flexible when it comes to working with the captured traffic and displaying the captured traffic on the CLI.įinally, both Wireshark and Embedded Packet Capture can be CPU and Memory intensive processes. In summary, Embedded Packet Capture is a method of capturing and displaying traffic in IOS XE. This article is to help network administrators differentiate between Wireshark and EPC and to show examples of both methods. Wireshark requires a DNA Advantage term license and EPC requires a Network Essentials perpetual license, this has created confusion. Some monitor capture commands in IOS XE use Wireshark others use EPC. SPAN is another way of redirecting traffic to a monitoring destination but has no local display, this article is NOT about SPAN. Wireshark can also be an application that runs as a container on C9300 and C9400, this article is NOT about that. Wireshark is an application that runs natively inside of IOS XE on the Cat 9k. This is a longer and more awkward looking filter, but you might finder it easier to create since the comparison logic is more straightforward.Wireshark and Embedded Packet Capture (EPC) are methods of capturing and or displaying captured traffic on an IOS XE box. (ether=0x0 and ether=0x0f and ether=0xcc) or (ether=0x0 and ether=0x0f and ether=0xcc) You could also just examine each byte individually: This filter uses 'ether' and 'ether' to examine the first four bytes of the destination MAC address and source MAC address, but then uses '& 0xffffff00' to mask the fourth byte before making the comparison. So 'ether' is valid, as is 'ether' or 'ether' but not 'ether'. The problem I ran into was that we're trying to examine three bytes, but the length value in a capture filter byte offset expression can only be 1, 2, or 4 bytes. This was only a first attempt for me at using byte offset notation in a capture filter, so maybe someone can shorten the syntax. I was able to limit my capture to traffic to and from Netopia devices (OUI 00:0f:cc) with:

There are no keywords that let you do that, but you can accomplish what you want with a byte offset filter.

Wireshark capture filter for subnet range