Monitor Capture Export - Cisco Catalyst 3650 series Command Reference Manual

monitor capture export

monitor capture export
To export a monitor capture (WireShark) to a file, use the monitor capture export command in privileged
EXEC mode.
monitor capture {capture-name} export file-location : file-name
Syntax Description
capture-name
file-location : file-name
Command Default
The captured packets are not stored.
Command Modes
Privileged EXEC
Command History
Release
Cisco IOS XE 3.3SE
Usage Guidelines
Use the monitor capture export command only when the storage destination is a capture buffer. The file
may be stored either remotely or locally. Use this command either during capture or after the packet capture
has stopped. The packet capture is stopped when one or more end conditions have been met or you entered
the monitor capture stop command.
When WireShark is used on switches in a stack, packet captures can be stored only on the devices specified
for file-location above that are connected to the active switch. Example: flash1 is connected to the active
switch. flash2 is connected to the secondary switch. Only flash1 can be used to store packet captures.
Note Attempts to store packet captures on unsupported devices or devices not connected to the active switch
will probably result in errors.
Examples To export the capture buffer contents to mycap.pcap on a flash drive:
Device# monitor capture mycap export flash:mycap.pcap
Command Reference, Cisco IOS XE Everest 16.5.1a (Catalyst 3650 Switches)
496
The name of the capture to be exported.
(Optional) Specifies the location and file name of the capture storage file.
Acceptable values for file-location :
• flash—On-board flash storage
• (usbflash0:)— USB drive
Modification
This command was introduced.