Example: Using Buffer Capture - Cisco Catalyst 4500 series Administration Manual

Usage Examples for Wireshark
Confirm that the capture point has been correctly defined by entering:
Step 2
Switch# show monitor capture mycap parameter
monitor capture mycap interface GigabitEthernet3/1 in
monitor capture mycap match ipv4
monitor capture mycap file location bootflash:mycap.pcap
monitor capture mycap limit packets 100 duration 60
Switch# show monitor capture mycap
Target Type:
Interface: GigabitEthernet3/1, Direction: in
Status : Inactive
Filter Details:
IPv4
Protocol: any
File Details:
Associated file name: bootflash:mycap.pcap
Buffer Details:
Buffer Type: LINEAR (default)
Limit Details:
Number of Packets to capture: 100
Packet Capture duration: 60
Step 3 Launch packet capture by entering:
Switch# monitor capture mycap start
Step 4 After sufficient time has passed, stop the capture by entering:
Switch# monitor capture mycap stop
Note
The mycap.pcap file now contains the captured packets.
Display the packets by entering:
Step 5
Switch# show monitor capture file bootflash:mycap.pcap
0.000000
1.000000
2.000000
3.000000
4.000000
5.000000
6.000000
7.000000
8.000000
9.000000
Step 6 Delete the capture point by entering:
Switch# no monitor capture mycap

Example: Using Buffer Capture

This example shows how to use buffer capture:
Software Configuration Guide—Release IOS XE 3.6.0E and IOS 15.2(2)E
59-20
Source IP: any
Destination IP: any
Alternatively, you could let the capture operation stop automatically after the time has elapsed
or the packet count has been met.
10.1.1.30 -> 20.1.1.2
10.1.1.31 -> 20.1.1.2
10.1.1.32 -> 20.1.1.2
10.1.1.33 -> 20.1.1.2
10.1.1.34 -> 20.1.1.2
10.1.1.35 -> 20.1.1.2
10.1.1.36 -> 20.1.1.2
10.1.1.37 -> 20.1.1.2
10.1.1.38 -> 20.1.1.2
10.1.1.39 -> 20.1.1.2
any any
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
Chapter 59 Configuring Wireshark
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
OL_28731-01