1.3.a Use IOS troubleshooting tools

1.3.a [iii] Embedded packet capture

Use the Embedded Packet Capture (EPC)
feature in Cisco IOS® Software Release 12.4(20)T and
higher to capture the network traffic into an internal
capture buffer; then, using the Embedded Event
Manager (EEM), the capture can be automatically
started and stopped as required—once the required
network traffic has been captured, tools such as
Wireshark can be used to analyze the packets
See:

http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/epc/configuration/xe-3s/asr1000/epc-xe-3s-asr1000-book/nm-packet-capture-xe.html