Example 3: Using Buffer Capture - Cisco Catalyst 4500 Series Configuration Manual

Chapter 56 Configuring Wireshark
Protocol: any
File Details:
Associated file name: bootflash:mycap.pcap
Buffer Details:
Buffer Type: LINEAR (default)
Limit Details:
Number of Packets to capture: 100
Packet Capture duration: 60
Step 3 Launch packet capture.
Switch# monitor capture mycap start
Step 4 After sufficient time has passed, stop the capture.
Switch# monitor capture mycap stop
Note
The mycap.pcap file now contains the captured packets.
Display the packets.
Step 5
Switch# show monitor capture file bootflash:mycap.pcap
0.000000
1.000000
2.000000
3.000000
4.000000
5.000000
6.000000
7.000000
8.000000
9.000000
Step 6 Delete the capture point.
Switch# no monitor capture mycap

Example 3: Using Buffer Capture

This example shows how to use buffer capture:
Step 1 Launch a capture session with the buffer capture option:
Switch# monitor capture mycap interface gi 3/1 in
Switch# monitor capture mycap match ipv4 any any
Switch# monitor capture mycap buffer circular size 1
Switch# monitor capture mycap start
Determine whether the capture is active.
Step 2
Switch# show monitor capture mycap
Status Information for Capture mycap
Target Type:
Interface: GigabitEthernet3/1, Direction: in
OL-25340-01
Source IP: any
Destination IP: any
Alternatively, you can allow the capture operation stop automatically after the time has elapsed
or the packet count has been met.
10.1.1.30 -> 20.1.1.2
10.1.1.31 -> 20.1.1.2
10.1.1.32 -> 20.1.1.2
10.1.1.33 -> 20.1.1.2
10.1.1.34 -> 20.1.1.2
10.1.1.35 -> 20.1.1.2
10.1.1.36 -> 20.1.1.2
10.1.1.37 -> 20.1.1.2
10.1.1.38 -> 20.1.1.2
10.1.1.39 -> 20.1.1.2
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
Software Configuration Guide—Release IOS XE 3.3.0SG and IOS 15.1(1)SG
Usage Examples for Wireshark
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
56-19