Activating And Deactivating A Capture Point - Cisco Catalyst 4500 Series Configuration Manual

Guidelines and Restrictions
Specifying a memory buffer size for packet burst handling
Switch# monitor capture mycap buffer-size 1000000
Defining an explicit core system filter to match both IPv4 and IPv6 TCP traffic
Switch# monitor capture mycap match any protocol tcp
Defining a core system filter using an existing ACL or class-map
Switch# monitor capture mycap match access-list myacl
Switch# monitor capture mycap match class-map mycm

Activating and Deactivating a Capture Point

A capture point cannot be activated unless an attachment point and a core system filter have been defined
and the associated filename (if any) does not already exist. A capture point with no associated filename
can only be activated to display. If no capture or display filters are specified, all of the packets captured
by the core system filter are displayed. The default display mode is brief.
To activate or deactivate a capture point, perform these tasks:
Command
monitor capture name start [capture-filter filter-string]
[display [display-filter filter-string]] [brief | detailed |
dump]
monitor capture name stop
Example:
Switch# monitor capture mycap start capture-filter
"net 10.1.1.0 0.0.0.255 and port 80"
Switch# monitor capture mycap start display
display-filter "net 10.1.1.0 0.0.0.255 and port
80"
Guidelines and Restrictions
•
•
•
•
•
Software Configuration Guide—Release IOS XE 3.3.0SG and IOS 15.1(1)SG
56-10
When packet capture is enabled in the input direction, the matching packets undergo software-based
lookup in the CPU for the first 15 seconds. During this time, CPU usage is high and capture rate is
low.
When packet capture is enabled in the output direction, packets are not captured in the first 15
seconds.
Packets captured in the output direction of an interface might not reflect the changes made by switch
rewrite (includes TTL, VLAN tag, CoS, checksum, and MAC addresses).
Capturing at a physical port that belongs to another logical port may not be supported. For example,
capturing at EtherChannel member ports is not supported.
Limiting circular file storage by file size is not supported.
Purpose
Activates a capture point.
Deactivates a capture point.
Chapter 56 Configuring Wireshark
OL-25340-01