56-4
Software Configuration Guide—Release IOS XE 3.3.0SG and IOS 15.1(1)SG
OL-25340-01
Chapter 56 Configuring Wireshark
About Wireshark
Note The capture filter syntax matches that of the Wireshark display filter. The syntax for capture and display
filters are identical in the Wireshark implementation on the Catalyst 4500 series switch.
Display Filter
With the display filter, you can direct Wireshark to further narrow the set of packets to display when
decoding and displaying from a .pcap file. Because the syntax of the display filter is identical to the
capture filter, the display filter is superfluous if a capture filter is also defined.
For more details on the syntax of capture and display filters, go to
http://wiki.wireshark.org/DisplayFilters
Actions
Wireshark can be invoked on live traffic or on a previously existing .pcap file. When invoked on live
traffic, it can perform four types of actions on packets that pass its capture and display filters:
• Captures to buffer in memory to decode and analyze and store
• Stores to a .pcap file
• Decodes and displays
• Stores and displays
When invoked on a .pcap file only, only the decode and display action is applicable.
Storing Captured Packets to Buffer in Memory
Packets can be stored in the capture buffer in memory for subsequent decode, analysis, or storage to a
.pcap file.
The capture buffer can be linear or circular mode. In linear mode, new packets are discarded when the
buffer is full. In circular mode, if the buffer is full, the oldest packet are discarded to accommodate the
new packet. Although the buffer can also be cleared when needed, this mode is mainly used for
debugging network traffic.
Storing Captured Packets to a .pcap File
Wireshark can store captured packets to a .pcap file. The capture file can be located on the following
storage devices:
• Catalyst 4500 series switch on-board flash storage (bootflash:)
• external flash disk (slot:)
• USB drive (usb0:)
Note Do not attempt to use Wireshark with any other devices.
To Next Page
Loading...
