Monitor Capture Start - Cisco Catalyst 4500 Series Command Reference Manual

Chapter 2 Cisco IOS Commands for the Catalyst 4500 Series Switches

monitor capture start

To start or stop a capture point, use the monitor capture command.
Syntax Description name
start
capture-filter filter-string
display [display-filter filter-string]
[brief | detailed | dump]
stop
Defaults The default display mode is brief.
Command Modes
Privileged EXEC mode
Command History Release
IOS XE 3.3.0SG/
15.1(1)SG
Usage Guidelines These commands start or stop a capture session, assuming all mandatory parameters are specified. We
must ensure that resources like CPU and memory are available before starting the session. Because the
capture and display filters must observe the Wireshark display filter syntax, ensure that the filters are
accurate (for example, specify the filters within double-quotes).
If the packets will be stored and displayed, do not use display filter; in this mode, if a packet is stored,
it is displayed as well. If you provide a display filter, it is ignored.
If a capture filter is specified, the capture is limited to 65536 packets. In this release, there is a limitation
that the timestamp will be incorrect when we use a capture filter.
Examples
The following example shows how to start or stop a capture session in various modes:
Switch# monitor capture mycap int gi 3/1 in match ipv4 any any
Switch# monitor capture mycap file location bootflash:mycap.pcap
Switch# monitor capture mycap limit packets 100 duration 60
Switch# monitor capture mycap start
Switch#
Switch# monitor capture mycap stop
Switch# monitor capture mycap start capture-filter "udp.port == 20001"
Switch# monitor capture mycap stop
OL-27596 -01
monitor capture name start [capture-filter filter-string] [display [display-filter filter-string]]
[brief | detailed | dump | stop]
Modification
Support for this command was introduced on the Catalyst 4500 series switch.
Catalyst 4500 Series Switch Cisco IOS Command Reference—Release IOS XE 3.4.0SG and IOS 15.1(2)SG)
Specifies a capture point.
Starts the Wireshark session and captures live traffic.
Specifies the capture filter.
Decodes and displays the filter. Optionally, specifies the display
filter.
Specifies the display mode. Default is brief.
Stops the Wireshark session.
monitor capture start
2-475