Activating And Deactivating A Capture Point - Cisco Catalyst 4500 Series Software Configuration Manual

Monitoring Wireshark

Activating and Deactivating a Capture Point

A capture point cannot be activated unless an attachment point and a core system filter have been defined
and the associated filename (if any) does not already exist. A capture point with no associated filename
can only be activated to display. If no capture or display filters are specified, all of the packets captured
by the core system filter are displayed. The default display mode is brief.
To activate or deactivate a capture point, perform these tasks:
Command
monitor capture name start [capture-filter filter-string]
[display [display-filter filter-string]] [brief | detailed |
dump]
monitor capture name stop
Example:
Switch# monitor capture mycap start capture-filter
"net 10.1.1.0 0.0.0.255 and port 80"
Switch# monitor capture mycap start display
display-filter "net 10.1.1.0 0.0.0.255 and port
80"
Configuring Wireshark on VSS
To configure Wireshark in the VSS standby switch, use the remote login command:
Switch_VSS# remote login module 11
Connecting to standby virtual console
Type "exit" or "quit" to end this session
Switch_VSS-standby-console# monitor capture mycap match any interface gi2/1/1 in file
location bootflash:text.pcap
Monitoring Wireshark
The commands in the following table are used to monitor Wireshark.
Table 68-2 Wireshark Monitoring Commands
Command
show monitor capture point name
show monitor capture file name
[display-filter filter-string] [brief |
detailed | dump]
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
68-14
Purpose
Activates a capture point.
Deactivates a capture point.
Purpose
Displays the capture point state so that you can see what capture points
are defined, what their attributes are, and whether they are active. When
capture point name is specified, it displays specific capture point's
details.
Activates Wireshark using an existing .pcap file as the source for
packets. If no display filter is specified, all of the packets in the file are
displayed. The default display mode is brief.
Chapter 68 Configuring Wireshark