Dell N1100-ON Reference Manual page 639

The in memory buffer is 128 packets.
The file system buffer is 524288 bytes and is named cpuPktCapture.pcap.
The remote monitor capture port is 2002.
Command Modes
Global Configuration mode
User Guidelines
Packets that are transmitted or received by the switch CPU may be captured
to the switch file system, to local memory, or sent to a WireShark client.
Packets captured to the switch file system are stored in pcap format and may
be copied from the system and opened with WireShark or TShark or other
utilities. Packets sent to the console are written in ASCII hex format.
When WireShark is configured and connected to the switch, packet capture
is controlled by WireShark. See the Users Configuration Guide for an
example of how to configure WireShark for packet capture.
Changes to configuration take effect on the next execution of the monitor
capture start command.
Only one of file, remote, or line may be specified. Setting the file, remote, or
line stops the capture.
No monitor capture file size returns the capture file size to the defaults
No monitor capture remote port returns the TCP port to the default
The administrator can capture packets into one of the following locations:
memory, switch NVRAM, or directly to a Wireshark analyzer.
Example
Configure capture for Wireshark remote access on port 2020:
console(config)#monitor capture remote port 2020
console(config)#monitor capture mode remote
console(config)#exit
console#monitor capture start
Copy the local capture file to a TFTP server
console#copy flash://cpuPktCapture.pcap tftp://10.267.9.99/mypkts.pcap
639
Layer 2 Switching Commands