Cisco IOS Port Mirroring for Packet Capture

Last week, I have posted about Cisco IOS embedded packet capture. All procedure was did in (internal) Cisco device. If you concern about high CPU and memory because of that, You can use external packet capture (example: TCPdump, Wireshark). Cisco device need some config to do external packet capture.

Please find the config

#### Port source mirror
IOS(config)# monitor session 1 source interface fastethernet 0/1

#### Port for result mirror (TCPdump/Wireshark)
IOS(config)# monitor session 1 destination interface fastethernet 0/24

#### Verify
IOS# show monitor session 1