Examples - Cisco Catalyst 4500 Series Configuration Manual

Chapter 56 Configuring Wireshark
Command
[no] monitor capture mycap match mac {src-mac-addr
src-mac-mask | any | host src-mac-addr} | {dest-mac-addr
dest-mac-mask | any | host dest-mac-addr}
[no] monitor capture mycap match {ipv4 | ipv6}
[src-prefix/length | any | host src-ip-addr] [dest-prefix/length
| any | host dest-ip-addr]
[no] monitor capture mycap match {ipv4 | ipv6} proto
{tcp | udp} [src-prefix/length | any | host src-ip-addr] [eq |
gt | lt | neq <0-65535>] [dest-prefix/length | any | host
dest-ip-addr] [eq | gt | lt | neq <0-65535>]
To define a capture point, use the following commands:
Command
monitor capture name [{interface name | vlan num |
control-plane} {in | out | both}
monitor capture name [[file location filename [buffer-size
<1-100>] [ring <2-10>] [size <1-100>]] | [buffer [circular]
size <1-100>]]
[no] monitor capture name limit {duration seconds]
[packet-length size] [packets num]
To clear the buffer contents, use the following command
Command
monitor capture [clear | export filename]
To start and stop a capture point, use the following command:
Command
monitor capture name start [capture-filter filter-string]
[display [display-filter filter-string]] [brief | detailed |
dump | stop]

Examples

Associating/disassociating a capture file
Switch# monitor capture point mycap file location bootdisk:mycap.pcap
Switch# no monitor capture mycap file
OL-25340-01
Purpose
Specifies use of a filter for MAC.
To remove the filter, use the no form of this command.
Specifies a filter for IPv4/IPv6, use one of the formats.
To remove the filters, use the no form of this command.
Purpose
Specifies one or more attachment points with direction.
To remove the attachment point, use the no form of this
command.
Specifies the capture destination.
To remove the details, use the no form of this command.
Specifies capture limits.
To remove the limits, use the no form of this command.
Purpose
Clears capture buffer contents or stores the packets to a file.
Purpose
To start or stop a capture point, use the monitor capture
command.
Software Configuration Guide—Release IOS XE 3.3.0SG and IOS 15.1(1)SG
Configuring Wireshark
56-9