IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

TCP dump file conversion

Updated: August 12, 2026

Want to summarize with AI?

Explains how the TCP dump file converter supports troubleshooting by converting stored binary TCP packet traces into text or pcap format, and describes feature behavior, storage considerations, platform support, and available trace-viewing methods.

The TCP dump file converter is a troubleshooting tool that

converts binary tcp_ios-xr dump files into text or pcap format
processes all stored packet traces in one operation, and
supports analysis with command-line, third-party, or open-source tools.

When nonstop routing (NSR) is disabled or a session flaps, TCP stores the 200 most recent packet traces in binary files in a temporary folder. The traces can contain data about configured routing protocols and network traffic that traverses the router.

Table 1. Feature History Table
Feature Name	Release Information	Description
TCP dump file converter	Release 25.4.1	Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only*) This feature is supported on: 8011-32Y8L2H2FH 8011-12G12X4Y-A/D
TCP dump file converter	Release 25.1.1	Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100])(select variants only*) This feature is supported on: 8712-MOD-M 8011-4G24Y4H-I
TCP dump file converter	Release 24.4.1	Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100])(select variants only); Modular Systems (8800 [LC ASIC: P100])(select variants only) *This feature is supported on: 8212-48FH-M 8711-32FH-M 88-LC1-36EH 88-LC1-12TH24FH-E 88-LC1-52Y8H-EM
TCP dump file converter	Release 24.2.11	You can now convert an entire TCP dump of packet traces in binary files into readable formats such as text or pcap, which makes it easier to analyze them for troubleshooting using third-party or open-source tools. This feature saves time and effort by preventing the need to examine each packet for failure. This feature introduces the tcp dump-file convert command.

Packet trace viewing methods

You can inspect stored TCP packet traces in these ways:

Use tcp dump-file convert to convert all stored binary files into pcap, text, or both formats. This method supports efficient analysis of multiple files.
Use show tcp dump-file <binary-filename> to display one binary file at a time in text format.

TCP dump file storage and conversion limitations

Review these limitations before you inspect or convert TCP dump files.

TCP dump file storage and viewing have these limitations:

The router stores only the 200 most recent message exchanges that occurred immediately before session termination, while NSR was disabled, or during a session flap.
The show tcp dump-file <binary-filename> command displays only one binary file at a time in text format.
When NSR is disabled, the router stores TCP dump files only for major protocols such as Border Gateway Protocol (BGP), Multicast Source Discovery Protocol (MSDP), and Multiprotocol Label Switching Label Distribution Protocol (MPLS LDP).

Convert TCP dump files to readable formats

Use this procedure to convert all stored binary TCP packet traces into text and pcap files for troubleshooting.

By default, the router stores converted files in the /harddisk:/decoded_dumpfiles directory.

Procedure

Convert all stored TCP dump files into text and pcap formats.

Example:

Router# tcp dump-file convert all-formats all
ascii file is saved at:
/harddisk:/decoded_dumpfiles/text_tcpdump_peer_all_node0_RP0_CPU0_2024_3_19_10_8_53.462070.txt
pcap file is saved at:
/harddisk:/decoded_dumpfiles/pcap_tcpdump_peer_all_node0_RP0_CPU0_2024_3_19_10_8_40.154838.pcap
[OK]

Use the location node-id and file <file-path> keywords to select a node and destination path.

Router# tcp dump-file convert all-formats all location 0/RP0/CPU0 file /harddisk:/demo2
ascii file is saved at: /harddisk:/demo2.txt
pcap file is saved at: /harddisk:/demo2.pcap
[OK]

For complete command syntax, see the tcp dump-file convert command in the applicable system management command reference.

The router creates a text file and a pcap file in the default or specified directory.

Display the converted text file in the CLI.

Example:

Router# run cat /harddisk:/decoded_dumpfiles/text_tcpdump_peer_all_node0_RP0_CPU0_2024_3_19_10_8_53.462070.txt
Filename: 2024_3_19_10_8_53.462070

==============================================================
Connection state is CLOSED, I/O status: 0, socket status: 103
PCB 0x0000000000f47a80, SO 0xf476d0, TCPCB 0xf6a370, vrfid 0x60000000,
Pak Prio: Medium, TOS: 192, TTL: 255, Hash index: 563
Local host: 2001:DB8::1, Local port: 47743 (Local App PID: 19579)
Foreign host: 2001:DB8::2, Foreign port: 179
(Local App PID/instance/SPL_APP_ID: 19579/1/0)

Current send queue size in bytes: 0 (max 0)
Current receive queue size in bytes: 0 (max 0) mis-ordered: 0 bytes
Current receive queue size in packets: 0 (max 0)

Timer         Starts   Wakeups        Next (msec)
Retrans           70         2                  0
SendWnd            0         0                  0
TimeWait           2         0                  0
AckHold           66        61                  0
KeepAlive          1         0                  0
PmtuAger           0         0                  0
GiveUp             0         0                  0
Throttle           0         0                  0
FirstSyn           1         1                  0

    iss: 3113104891 snduna: 3113106213 sndnxt: 3113106213
 sndmax: 3113106213 sndwnd: 31523      sndcwnd: 2832
    irs: 4250126727 rcvnxt: 4250128049 rcvwnd: 31448 rcvadv: 4250159497

The CLI displays the decoded packet trace. The sample shows only part of the available output.

Copy the converted packet traces from the router to a local computer with a remote file copy command such as scp .

Open the copied pcap file in the packet-analysis tool used by your organization.

The stored packet traces are available in readable text and pcap formats for troubleshooting.

View a TCP dump file in text format manually

Use this procedure to inspect one binary TCP packet trace without using the TCP dump file converter.

Manual viewing displays one binary file at a time. Use the converter when you must process multiple files.

Procedure

Display the binary packet trace files in the TCP dump directory.

Example:

Router# show tcp dump-file list all
total 1176
-rw-r--r-- 1 root root 5927 Nov 22 12:42 31_0_0_126.179.20966.cl.1700656933
-rw-r--r-- 1 root root 5892 Nov 22 12:42 31_0_0_127.179.35234.cl.1700656933
-rw-r--r-- 1 root root 6148 Nov 22 12:42 31_0_0_149.179.54939.cl.1700656933
-rw-r--r-- 1 root root 5894 Nov 22 12:42 31_0_0_155.179.18134.cl.1700656933
-rw-r--r-- 1 root root 6063 Nov 22 12:42 31_0_0_156.179.25445.cl.1700656933
-rw-r--r-- 1 root root 5860 Nov 22 12:42 31_0_0_161.179.30859.cl.1700656933
-rw-r--r-- 1 root root 5832 Nov 22 12:42 31_0_0_173.179.36935.cl.1700656933
-rw-r--r-- 1 root root 5906 Nov 22 12:42 31_0_0_190.179.25642.cl.1700656933

Display the selected binary file in text format.

Example:

Router# show tcp dump-file 10_106_0_73.179.34849.cl.1707424077 location 0/RP0/CPU0
Filename: 10_106_0_73.179.34849.cl.1707424077

==============================================================
Connection state is CLOSED, I/O status: 0, socket status: 103
PCB 0x00007f86bc05e3b8, SO 0x7f86bc05e648, TCPCB 0x7f86bc0c3718, vrfid 0x60000000,
Pak Prio: Medium, TOS: 192, TTL: 1, Hash index: 1593
Local host: 10.106.0.72, Local port: 179 (Local App PID: 11354)
Foreign host: 10.106.0.73, Foreign port: 34849
(Local App PID/instance/SPL_APP_ID: 11354/1/0)

Current send queue size in bytes: 0 (max 0)
Current receive queue size in bytes: 0 (max 0) mis-ordered: 0 bytes
Current receive queue size in packets: 0 (max 0)

Timer         Starts   Wakeups        Next (msec)
Retrans       103448         8                  0
SendWnd            0         0                  0
TimeWait           1         0                  0
AckHold       106815    106545                  0
KeepAlive          1         0                  0
PmtuAger           0         0                  0
GiveUp             0         0                  0
Throttle           0         0                  0
FirstSyn           0         0                  0

    iss: 161240548  snduna: 163206936  sndnxt: 163206936
 sndmax: 163206936  sndwnd: 63104      sndcwnd: 18120
    irs: 3691232436 rcvnxt: 3693473072 rcvwnd: 26099 rcvadv: 3693499171

The CLI displays the decoded packet trace. The sample shows only part of the available output.

The selected binary TCP dump file is available as readable text in the CLI.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.