Cisco Catalyst 4500 Series Command Reference Manual page 528

monitor capture file location buffer-size
Do not specify any other devices.
The destination file can be a ring of files rather than a single file. The ring option specifies the number
of files in the ring whereas size specifies the total size of all the files. In ring file mode, when the file
size limit has reached, it accommodates space for new packets by removing the oldest file.
If the capture destination is a buffer, you must use the show command to decode and display the packets
from the buffer. If the circular option is specified, capture continues until you explicitly issue the stop
command. If no space exists in the buffer, oldest packet(s) are removed to accommodate the new ones.
If the circular option is not provided, newer packets are discarded when the capture buffer is full.
Examples The following example usages show how to specify a file or a ring of files as the capture destination:
Switch# monitor capture mycap associate buffer-size 1000000file location
bootflash:mycap.pcap
Switch# monitor capture mycap file location bootflash:mycap.pcap size 40
Switch# monitor capture mycap file location bootflash:mycap.pcap ring 4 size 40
Switch# monitor capture mycap file location bootflash:mycap.pcap buffer-size 8
Switch# monitor capture mycap file location bootflash:mycap.pcap ring 4 size 40
buffer-size 16
Switch# no monitor capture mycap file
The following example shows how to setup capture in lock-step mode:
Switch# monitor capture mycap file location bootflash:mycap.pcap buffer-size 64
Switch# no monitor capture mycap file
The following example shows how to make a circular buffer as the capture destination and operate on
the buffer:
Switch# monitor capture mycap int gi 3/1 in match ipv4 any any
Switch# monitor capture mycap buffer circular size 1
Switch# monitor capture mycap start
Switch#
Switch# sh monitor capture mycap buffer
0.000000
1.000000
2.000000
3.000000
4.000000
5.000000
6.000000
7.000000
8.000000
9.000000
10.000000
11.000000
12.000000
Switch# sh monitor capture mycap buffer detailed
Frame 1: 256 bytes on wire (2048 bits), 256 bytes captured (2048 bits)
Catalyst 4500 Series Switch Cisco IOS Command Reference—Release IOS XE 3.4.0SG and IOS 15.1(2)SG)
2-470
10.1.1.164 -> 20.1.1.2
10.1.1.165 -> 20.1.1.2
10.1.1.166 -> 20.1.1.2
10.1.1.167 -> 20.1.1.2
10.1.1.168 -> 20.1.1.2
10.1.1.169 -> 20.1.1.2
10.1.1.170 -> 20.1.1.2
10.1.1.171 -> 20.1.1.2
10.1.1.172 -> 20.1.1.2
10.1.1.173 -> 20.1.1.2
10.1.1.174 -> 20.1.1.2
10.1.1.175 -> 20.1.1.2
10.1.1.176 -> 20.1.1.2
Arrival Time: Apr 12, 2012 10:59:06.255983000 PDT
Epoch Time: 1334253546.255983000 seconds
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 256 bytes (2048 bits)
Capture Length: 256 bytes (2048 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: eth:ip:udp:data]
Chapter 2 Cisco IOS Commands for the Catalyst 4500 Series Switches
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
OL-27596 -01