How to use the embedded wireshark in Cisco 3850 switches to capture the traffic

On the 3850 switches has embedded wireshark that can be used to packet capture during the troubleshooting this negate the need of SPAN to capture the traffic.

-Define your source
monitor capture mycap interface GigabitEthernet1/0/1 both

-Set your match statement
monitor capture mycap access-list myacl monitor capture mycap match ipv4 any any

-Set your destination (packet capture can be stored on the USB or flash storage only)
monitor capture mycap file location flash:mycap.pcap buffer-size 1 monitor capture mycap file location usbflash0:

(Optional): set packet limit and/or duration
monitor capture mycap limit packets 100 duration

-To start the packet capture we need to enter the command ‘monitor capture mycap start’ . To stop the packet capture use the ‘monitor capture mycap stop’