Contents
57
Software Configuration GuideāRelease IOS XE 3.9.xE and IOS 15.2(5)Ex
Guidelines for Wireshark 68-2
Restrictions for Wireshark 68-4
Information about Wireshark 68-5
Capture Points 68-6
Attachment Points 68-6
Filters 68-6
Core System Filter 68-7
Capture Filter 68-7
Display Filter 68-7
Input and Output Classification 68-7
Actions 68-8
Storing Captured Packets to Buffer in Memory 68-8
Storing Captured Packets to a .pcap File 68-8
Decoding and Displaying Packets 68-9
Displaying Live Traffic 68-9
Displaying from the .pcap File 68-9
Storing and Displaying Packets 68-9
Activating and Deactivating Wireshark Capture Points 68-10
Wireshark Features used in Switches 68-10
Wireshark on VSS 68-11
How to Configure Wireshark 68-11
Default Wireshark Configuration 68-11
Defining, Modifying, or Deleting a Capture Point 68-12
Examples 68-13
Activating and Deactivating a Capture Point 68-14
Configuring Wireshark on VSS 68-14
Monitoring Wireshark 68-14
Configuration Examples for Wireshark 68-15
Example: Displaying a Brief Output from a .pcap File 68-15
Example: Displaying Detailed Output from a .pcap File 68-15
Example: Displaying a Hexadecimal Dump Output from a .pcap File 68-17
Example: Displaying Packets from a .pcap File with a Display Filter 68-18
Usage Examples for Wireshark 68-18
Example: Simple Capture and Display 68-18
Example: Simple Capture and Store 68-19
Example: Using Buffer Capture 68-20
Example: Capture Sessions 68-24
Example: Capture and Store in Lock-step Mode 68-28
Example: Simple Capture and Store in Lock-step with High-speed Mode 68-29