Cisco Catalyst 4500 Series Software Configuration Guide

68-12
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 68 Configuring Wireshark
How to Configure Wireshark
Defining, Modifying, or Deleting a Capture Point
Although listed in sequence, the steps to specify values for the options can be executed in any order. You
can also specify them in one, two, or several lines. Except for attachment points, which can be multiple,
you can replace any value with a more recent value by redefining the same option, in the following order:
Step 1 Define the name that identifies the capture point.
Step 2 Specify the attachment point with which the capture point is associated.
Multiple attachment points can be specified. Range support is also available both for adding and
removing attachment points.
Step 3 Define the core system filter, defined either explicitly, through ACL or through a class map.
Step 4 Specify the session limit (in seconds or packets captured).
Step 5 Specify the packet segment length to be retained by Wireshark.
Step 6 Specify the file association, if the capture point intends to capture packets rather than merely display
them.
Step 7 Specify the size of the memory buffer used by Wireshark to handle traffic bursts.
To filter the capture point, use the following commands:
File size No limit
Ring file storage No
Buffer storage mode Linear
Table 68-1 Default Wireshark Configuration
Feature Default Setting
Command Purpose
[no] monitor capture mycap match {any | mac
mac-match-string | ipv4 ipv4-match-string | ipv6
ipv6-match-string}
Defines an explicitly in-line core filter.
To remove the filter, use the no form of this command.
[no] monitor capture mycap match mac {src-mac-addr
src-mac-mask | any | host src-mac-addr} | {dest-mac-addr
dest-mac-mask | any | host dest-mac-addr}
Specifies use of a filter for MAC.
To remove the filter, use the no form of this command.
[no] monitor capture mycap match {ipv4 | ipv6}
[src-prefix/length | any | host src-ip-addr] [dest-prefix/length
| any | host dest-ip-addr]
[no] monitor capture mycap match {ipv4 | ipv6} proto
{tcp | udp} [
src-prefix/length | any | host src-ip-addr] [eq |
gt | lt | neq <0-65535>] [dest-prefix/length | any | host
dest-ip-addr] [eq | gt | lt | neq <0-65535>]
Specifies a filter for IPv4/IPv6, use one of the formats.
To remove the filters, use the no form of this command.

Cisco Catalyst 4500 Series Specifications

General

Series	Catalyst 4500 Series
Category	Switch
Layer Support	Layer 2, Layer 3
Form Factor	Modular chassis
Stackable	No
Chassis Slots	3, 6, 7, 10
Power Supply Options	AC, DC
Redundancy	Power supply, Supervisor engine
Network Management	Cisco IOS Software CLI, SNMP, Cisco Prime Infrastructure
Features	Security, QoS
Port Density	Up to 384 ports per chassis
Security Features	802.1X, ACLs, DHCP Snooping, Dynamic ARP Inspection, IP Source Guard
Supervisor Engine	8-E