Cisco Catalyst 4500 Series - Monitor Capture Start

To Next Page

To Previous Page

2-475

Catalyst 4500 Series Switch Cisco IOS Command Reference—Release IOS XE 3.4.0SG and IOS 15.1(2)SG)

OL-27596 -01

Chapter 2 Cisco IOS Commands for the Catalyst 4500 Series Switches

monitor capture start

To start or stop a capture point, use the monitor capture command.

monitor capture name start [capture-filter filter-string] [display [display-filter filter-string]]

[brief | detailed | dump | stop]

Syntax Description

Defaults The default display mode is brief.

Command Modes Privileged EXEC mode

Command History

Usage Guidelines These commands start or stop a capture session, assuming all mandatory parameters are specified. We

must ensure that resources like CPU and memory are available before starting the session. Because the

capture and display filters must observe the Wireshark display filter syntax, ensure that the filters are

accurate (for example, specify the filters within double-quotes).

If the packets will be stored and displayed, do not use display filter; in this mode, if a packet is stored,

it is displayed as well. If you provide a display filter, it is ignored.

If a capture filter is specified, the capture is limited to 65536 packets. In this release, there is a limitation

that the timestamp will be incorrect when we use a capture filter.

Examples The following example shows how to start or stop a capture session in various modes:

Switch# monitor capture mycap int gi 3/1 in match ipv4 any any

Switch# monitor capture mycap file location bootflash:mycap.pcap

Switch# monitor capture mycap limit packets 100 duration 60

Switch# monitor capture mycap start

Switch#

Switch# monitor capture mycap stop

Switch# monitor capture mycap start capture-filter "udp.port == 20001"

Switch# monitor capture mycap stop

name Specifies a capture point.

start Starts the Wireshark session and captures live traffic.

capture-filter filter-string Specifies the capture filter.

display [display-filter filter-string] Decodes and displays the filter. Optionally, specifies the display

filter.

[brief | detailed | dump] Specifies the display mode. Default is brief.

stop Stops the Wireshark session.

Release Modification

IOS XE 3.3.0SG/

15.1(1)SG

Support for this command was introduced on the Catalyst 4500 series switch.

Other manuals for Cisco Catalyst 4500 Series