Cisco Catalyst 4500 Series Configuration Guide

56-10
Software Configuration Guide—Release IOS XE 3.3.0SG and IOS 15.1(1)SG
OL-25340-01
Chapter 56 Configuring Wireshark
Guidelines and Restrictions
Specifying a memory buffer size for packet burst handling
Switch# monitor capture mycap buffer-size 1000000
Defining an explicit core system filter to match both IPv4 and IPv6 TCP traffic
Switch# monitor capture mycap match any protocol tcp
Defining a core system filter using an existing ACL or class-map
Switch# monitor capture mycap match access-list myacl
Switch# monitor capture mycap match class-map mycm
Activating and Deactivating a Capture Point
A capture point cannot be activated unless an attachment point and a core system filter have been defined
and the associated filename (if any) does not already exist. A capture point with no associated filename
can only be activated to display. If no capture or display filters are specified, all of the packets captured
by the core system filter are displayed. The default display mode is brief.
To activate or deactivate a capture point, perform these tasks:
Guidelines and Restrictions
• When packet capture is enabled in the input direction, the matching packets undergo software-based
lookup in the CPU for the first 15 seconds. During this time, CPU usage is high and capture rate is
low.
• When packet capture is enabled in the output direction, packets are not captured in the first 15
seconds.
• Packets captured in the output direction of an interface might not reflect the changes made by switch
rewrite (includes TTL, VLAN tag, CoS, checksum, and MAC addresses).
• Capturing at a physical port that belongs to another logical port may not be supported. For example,
capturing at EtherChannel member ports is not supported.
• Limiting circular file storage by file size is not supported.
Command Purpose
monitor capture name start [capture-filter filter-string]
[display [display-filter filter-string]] [brief | detailed |
dump]
monitor capture name stop
Example:
Switch# monitor capture mycap start capture-filter
"net 10.1.1.0 0.0.0.255 and port 80"
Switch# monitor capture mycap start display
display-filter "net 10.1.1.0 0.0.0.255 and port
80"
Activates a capture point.
Deactivates a capture point.

Cisco Catalyst 4500 Series Specifications

General

Series	Catalyst 4500 Series
Category	Switch
Layer Support	Layer 2, Layer 3
Form Factor	Modular chassis
Stackable	No
Chassis Slots	3, 6, 7, 10
Power Supply Options	AC, DC
Redundancy	Power supply, Supervisor engine
Network Management	Cisco IOS Software CLI, SNMP, Cisco Prime Infrastructure
Features	Security, QoS
Port Density	Up to 384 ports per chassis
Security Features	802.1X, ACLs, DHCP Snooping, Dynamic ARP Inspection, IP Source Guard
Supervisor Engine	8-E