Debug using Access Control List

Below shows a sample debug session using access list on Cisco IOS Release 12.3:

RT1#sh run int fa0/0
Building configuration...

Current configuration : 97 bytes
!
interface FastEthernet0/0
 ip address 10.10.10.1 255.255.255.252
 duplex auto
 speed auto
end

RT1#
RT1#sh run | in access-list 101
access-list 101 permit icmp host 10.10.10.1 any
RT1#
RT1#debug ip packet 101
IP packet debugging is on for access list 101
RT1#
RT1#sh debug
Generic IP:
  IP packet debugging is on for access list 101
RT1#
RT1#ping ip 10.10.10.2 source 10.10.10.1 size 1600 repeat 1

Type escape sequence to abort.
Sending 1, 1600-byte ICMP Echos to 10.10.10.2, timeout is 2 seconds:
Packet sent with a source address of 10.10.10.1
!
Success rate is 100 percent (1/1), round-trip min/avg/max = 44/44/44 ms
RT1#
00:12:31: IP: tableid=0, s=10.10.10.1 (local), d=10.10.10.2 (FastEthernet0/0), routed via FIB
00:12:31: IP: s=10.10.10.1 (local), d=10.10.10.2 (FastEthernet0/0), len 1600, sending
00:12:31: IP: s=10.10.10.1 (local), d=10.10.10.2 (FastEthernet0/0), len 1500, sending fragment
00:12:31: IP: s=10.10.10.1 (local), d=10.10.10.2 (FastEthernet0/0), len 120, sending last fragment
RT1#

Note: The debug ip packet privileged command is only effective for packets originated from and destined to the device.