Show Monitor Capture File - Cisco Catalyst 4500 Series Command Reference Manual

show monitor capture file

show monitor capture file
To decode and display packets from a previously captured .pcap file, use the show monitor capture file
command.
Syntax Description name
display-filter filter-string
brief | detailed | dump
Defaults brief
Command Modes Privileged EXEC mode
Command History Release
IOS XE 3.3.0SG/
15.1(1)SG
Usage Guidelines If no display filter is specified, then all the packets in the file are displayed. Because the display filter
must observe the Wireshark display filter syntax, ensure that the display filter is accurate. Also, use a
double quotes when specifying the filter.
Examples
This example shows how to display packets from a .pcap file with a display filter:
Switch# show monitor capture file bootflash:test.pcap display-filter
This example displays a brief output from a .pcap file:
Switch# show monitor capture file bootflash:mycap.pcap
1
20002
2
20002
3
20002
Catalyst 4500 Series Switch Cisco IOS Command Reference—Release IOS XE 3.4.0SG and IOS 15.1(2)SG)
2-860
show monitor capture file name [display-filter filter-string] [brief | detailed | dump]
Specfies the filename.
Specifies the display filter string according to Wireshark's display-filter
syntax.
Determines the display mode.
Modification
Support for this command was introduced on the Catalyst 4500 series
switch.
0.000000 10.1.1.140 -> 20.1.1.2
1.000000 10.1.1.141 -> 20.1.1.2
2.000000 10.1.1.142 -> 20.1.1.2
Chapter 2 Cisco IOS Commands for the Catalyst 4500 Series Switches
brief—Displays a one line summary of the packet with key fields
detailed—Displays all the fields in the packet for the protocols
supported and displays the payload in hexadecimal form.
dump—Displays a one line summary of the packet with key fields
and also displays the packet in hexadecimal form.
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
Destination port:
Destination port:
Destination port:
OL-27596 -01