Empty pcap file with Embedded Packet Capture

Question

Hello,
I have configured the EPC in my CISCO 2901 CUBE for monitoring VOIP traffic.
#First I configure the type of traffic I want to filter
access-list 110 permit tcp any any eq 5060
access-list 110 permit tcp any any eq 5061
access-list 110 permit udp any any eq 5060
access-list 110 permit udp any any eq 5061
#Then my buffer (too big, I know..)
monitor capture buffer buff-SIP5 size 2048 max-size 9500
# I apply the access-list to the buffer
monitor capture buffer buff-SIP5 filter access-list 110
# Define the capture point, both interfaces, IN and OUT..
monitor capture point ip cef SIP5 all both 
#Associate capture point with buffer
monitor capture point associate SIP5 buff-SIP5
#Start the capture
monitor capture point start SIP5
#Stop it..
monitor capture point stop SIP5
#Check if you have what you need
show monitor cap buffer buff-SIP5 dump
#Export it using scp
monitor capture buffer buff-SIP5 export scp://[email protected]:/SIP5.pcap
I would like some help with these two issues:
1) When I export it, my pcap file is empty...yet when I do a dump, I can see everything I need
2) If I don't apply the access-list filter, I can see the SIP messages in the pcap file. However, I cannot see the messages that sends the SBC, only the ones that it receives.
Thanks in advance,
Gabriel

Answer 1

I tried recreating the packet capture with no access-list filtering.
show mon cap buff all para
Capture buffer cap (circular buffer)
Buffer Size : 1048576 bytes, Max Element Size : 68 bytes, Packets : 0
Allow-nth-pak : 0, Duration : 0 (seconds), Max packets : 0, pps : 0
Associated Capture Points:
Name : cap, Status : Active
Configuration:
monitor capture buffer cap circular
monitor capture point associate cap cap
interface GigabitEthernet1/1/1
 description UPLINK TO 6513
 switchport mode trunk
end