Packet capture (PCAP) provides the ability to copy control and data plane packets into a PCAP file for offline viewing and debugging. Debugging often requires packet mirroring. On the 7705 SAR, only remote file URLs are supported for PCAP.
PCAP is useful in situations where the routing infrastructure limits remote packet capture due to subnet segregation for security purposes or due to firewall and filter rules.
Capturing mirrored packets in a PCAP file offers the following benefits:
byte-level details for each captured packet
full protocol analysis for every protocol related to the mirror source
Third-party applications such as Wireshark, for example, have a complete set of decoders.
a single capture for all relevant protocol packets instead of enabling captures on a per-control protocol basis. The capture contains details in chronological order.
The PCAP feature uses the debug>mirror-source command. Hence applying mirroring to a port does not affect the port itself and does not require changes to the port.