Cisco Catalyst 4500 Series - Example 4: Capture Sessions

56-23
Software Configuration Guide—Release IOS XE 3.3.0SG and IOS 15.1(1)SG
OL-25340-01
Chapter 56 Configuring Wireshark
Usage Examples for Wireshark
9 8.000000 10.1.1.10 -> 20.1.1.2 UDP Source port: 20001 Destination port:
20002
10 9.000000 10.1.1.11 -> 20.1.1.2 UDP Source port: 20001 Destination port:
20002
11 10.000000 10.1.1.12 -> 20.1.1.2 UDP Source port: 20001 Destination port:
20002
12 11.000000 10.1.1.13 -> 20.1.1.2 UDP Source port: 20001 Destination port:
20002
13 12.000000 10.1.1.14 -> 20.1.1.2 UDP Source port: 20001 Destination port:
20002
14 13.000000 10.1.1.15 -> 20.1.1.2 UDP Source port: 20001 Destination port:
20002
15 14.000000 10.1.1.16 -> 20.1.1.2 UDP Source port: 20001 Destination port:
20002
16 15.000000 10.1.1.17 -> 20.1.1.2 UDP Source port: 20001 Destination port:
20002
Step 12 Stop the packet capture and display the buffer contents.
Switch# monitor capture mycap stop
Switch# show monitor capture mycap buffer brief
0.000000 10.1.1.2 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
1.000000 10.1.1.3 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
2.000000 10.1.1.4 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
3.000000 10.1.1.5 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
4.000000 10.1.1.6 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
5.000000 10.1.1.7 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
6.000000 10.1.1.8 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
7.000000 10.1.1.9 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
8.000000 10.1.1.10 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
9.000000 10.1.1.11 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
10.000000 10.1.1.12 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
11.000000 10.1.1.13 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
Step 13 Clear the buffer and then try to display packets from the buffer.
Switch# monitor capture mycap clear
Switch# show monitor capture mycap buffer brief
Step 14 Delete the capture point.
Switch# no monitor capture mycap
Example 4: Capture Sessions
The following examples show how to start or stop a capture session in various modes:
Switch# monitor capture mycap int gi 3/1 in match ipv4 any any
Switch# monitor capture mycap file location bootflash:mycap.pcap
Switch# monitor capture mycap limit packets 100 duration 60
Switch# monitor capture mycap start
Switch#
Switch# monitor capture mycap stop
Switch# monitor capture mycap start capture-filter "udp.port == 20001"
Switch# monitor capture mycap stop
Switch# monitor capture mycap start capture-filter "udp.port == 20001" display
A file by the same capture file name already exists, overwrite?[confirm]
0.000000 10.1.1.9 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.10 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002