59-23
Software Configuration Guide—Release IOS XE 3.6.0E and IOS 15.2(2)E
OL_28731-01
Chapter 59 Configuring Wireshark
Usage Examples for Wireshark
4.000000 10.1.1.6 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
5.000000 10.1.1.7 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
6.000000 10.1.1.8 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
7.000000 10.1.1.9 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
8.000000 10.1.1.10 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
9.000000 10.1.1.11 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
[Wait for about 10 secs]
Switch# show monitor capture mycap buffer brief
0.000000 10.1.1.2 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
1.000000 10.1.1.3 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
2.000000 10.1.1.4 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
3.000000 10.1.1.5 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
4.000000 10.1.1.6 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
5.000000 10.1.1.7 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
6.000000 10.1.1.8 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
7.000000 10.1.1.9 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
8.000000 10.1.1.10 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
9.000000 10.1.1.11 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
Step 6 Clear the packets from the buffer by entering:
Switch# monitor capture mycap clear
Step 7 Confirm that the buffer is now empty by entering:
Switch# show monitor capture mycap buffer brief
Wait about 10 seconds.
Step 8 Display the buffer contents.
Switch# show monitor capture mycap buffer brief
Step 9 Restart the traffic, wait about 10 seconds, then display buffer contents by entering:
Switch# show monitor capture mycap buffer brief
0.000000 10.1.1.2 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
1.000000 10.1.1.3 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
2.000000 10.1.1.4 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
3.000000 10.1.1.5 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
4.000000 10.1.1.6 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
5.000000 10.1.1.7 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
6.000000 10.1.1.8 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
7.000000 10.1.1.9 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
8.000000 10.1.1.10 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
9.000000 10.1.1.11 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
10.000000 10.1.1.12 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
Step 10 Store the buffer contents to the mycap1.pcap file in the internal bootflash: storage device.
Switch# monitor capture mycap export bootflash:mycap1.pcap
Exported Successfully
Step 11 Check that the file has been created and that it contains the packets by entering:
Switch# dir bootflash:mycap1.pcap
Directory of bootflash:/mycap1.pcap
14758 -rw- 20152 Apr 15 2012 16:00:28 -07:00 mycap1.pcap
831541248 bytes total (831340544 bytes free)
Switch# show monitor capture file bootflash:mycap1.pcap brief
1 0.000000 10.1.1.2 -> 20.1.1.2 UDP Source port: 20001 Destination port:
20002