2-860
Catalyst 4500 Series Switch Cisco IOS Command Reference—Release IOS XE 3.4.0SG and IOS 15.1(2)SG)
OL-27596 -01
Chapter 2 Cisco IOS Commands for the Catalyst 4500 Series Switches
show monitor capture file
show monitor capture file
To decode and display packets from a previously captured .pcap file, use the show monitor capture file
command.
show monitor capture file name [display-filter filter-string] [brief | detailed | dump]
Syntax Description
Defaults brief
Command Modes Privileged EXEC mode
Command History
Usage Guidelines If no display filter is specified, then all the packets in the file are displayed. Because the display filter
must observe the Wireshark display filter syntax, ensure that the display filter is accurate. Also, use a
double quotes when specifying the filter.
Examples This example shows how to display packets from a .pcap file with a display filter:
Switch# show monitor capture file bootflash:test.pcap display-filter
This example displays a brief output from a .pcap file:
Switch# show monitor capture file bootflash:mycap.pcap
1 0.000000 10.1.1.140 -> 20.1.1.2 UDP Source port: 20001 Destination port:
20002
2 1.000000 10.1.1.141 -> 20.1.1.2 UDP Source port: 20001 Destination port:
20002
3 2.000000 10.1.1.142 -> 20.1.1.2 UDP Source port: 20001 Destination port:
20002
name Specfies the filename.
display-filter filter-string Specifies the display filter string according to Wireshark’s display-filter
syntax.
brief | detailed | dump Determines the display mode.
brief—Displays a one line summary of the packet with key fields
detailed—Displays all the fields in the packet for the protocols
supported and displays the payload in hexadecimal form.
dump—Displays a one line summary of the packet with key fields
and also displays the packet in hexadecimal form.
Release Modification
IOS XE 3.3.0SG/
15.1(1)SG
Support for this command was introduced on the Catalyst 4500 series
switch.