269
This type of expression contains the following elements:
• proto—Specifies a protocol layer or packet field.
• […]—Matches a number of bytes relative to a protocol layer or packet field. Values for the bytes
to be matched must be a hexadecimal integer string. The expression in brackets can use the
following formats:
{ [n:m]—Matches a total of m bytes after an offset of n bytes from the beginning of the
specified protocol layer or field. To match only 1 byte, you can use both [n] and [n:1] formats.
For example, eth.src[0:3]==00:00:83 matches an Ethernet frame if the first three bytes of
its source MAC address are 0x00, 0x00, and 0x83. The eth.src[2] == 83 expression
matches an Ethernet frame if the third byte of its source MAC address is 0x83.
{ [n-m]—Matches a total of (m-n+1) bytes, starting from the (n+1)th byte relative to the
beginning of the specified protocol layer or packet field. For example, eth.src[1-2]==00:83
matches an Ethernet frame if the second and third bytes of its source MAC address are
0x00 and 0x83, respectively.
Configuring packet capture
Saving captured packets to a file
Perform this task to capture incoming packets on an interface and save the captured packets to a file.
To display the captured packets, use the packet-capture read command. To stop the capture while
it is capturing packets, press Ctrl+C. There might be a delay for the capture to stop because of
heavy traffic.
To save the captured packets to a file:
Task Command Remarks
Save the captured
packets to a file.
packet-capture interface
interface-type
interface-number [
capture-filter
capt-expression |
limit-captured-frames
limit |
limit-frame-size
bytes |
autostop
filesize
kilobytes |
autostop duration
seconds |
autostop files
numbers |
capture-ring-buffer filesize
kilobytes |
capture-ring-buffer duration
seconds |
capture-ring-buffer files
numbers ] *
write
filepath [
raw
| {
brief
|
verbose
} ]
*
After this command is executed,
you cannot configure other
commands from the CLI until the
capture completes capturing
packets or it is stopped.
Filtering packet data to display
To stop the capture while it is capturing packets, press Ctrl+C. There might be a delay for the capture
to stop because of heavy traffic.
To filter packet data to display:
Task Command Remarks
Filter packet data to
display.
packet-capture interface
interface-type
interface-number [
capture-filter
capt-expression |
display-filter
disp-expression |
limit-captured-frames
limit |
limit-frame-size
bytes |
autostop
duration
seconds ] * [
raw
| {
brief
|
verbose
} ] *
After this command is executed,
you cannot configure other
commands from the CLI until the
capture completes capturing
packets or it is stopped.
To Next Page
Loading...
Need help?
General
