Specifications

2-388
Catalyst 4500 Series Switch Cisco IOS Command Reference—Release IOS XE 3.3.0XO(15.1(1)XO)
OL_28738 -01
Chapter 2 Cisco IOS Commands for the Catalyst 4500 Series Switches
monitor capture start
monitor captur e start
To start or stop a capture point, use the monitor capture command.
monitor capture name start [capture-filter filter-string] [display [display-filter filter-string]]
[brief | detailed | dump | stop]
Syntax Description
Defaults T he default display mode is brief.
Command Modes Privileged EXE C mode
Usage Guidelines T hese commands start or stop a capture session, assuming all mandatory parameters are specified. We
must ensure that resources like CPU and memory are available before starting the session. Because the
capture and display filters must observe the Wireshark display filter syntax, ensure that the filters are
accurate (for example, specify the filters within double-quotes).
If the packets will be stored and displayed, do not use display filter; in this mode, if a packet is stored,
it is displayed as well. If you provide a display filter, it is ignored.
If a capture filter is specified, the capture is limited to 65536 packets. In this release, there is a limitation
that the timestamp will be incorrect when we use a capture filter.
Examples The following example shows how to start or stop a capture session in various mod es:
Switch# monitor capture mycap int gi 3/1 in match ipv4 any any
Switch# monitor capture mycap file location bootflash:mycap.pcap
Switch# monitor capture mycap limit packets 100 duration 60
Switch# monitor capture mycap start
Switch#
Switch# monitor capture mycap stop
Switch# monitor capture mycap start capture-filter "udp.port == 20001"
Switch# monitor capture mycap stop
Switch# monitor capture mycap start capture-filter "udp.port == 20001" display
A file by the same capture file name already exists, overwrite?[confirm]
0.000000 10.1.1.9 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.10 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.11 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
0.000000 10.1.1.12 -> 20.1.1.2 UDP Source port: 20001 Destination port: 20002
name Specifies a capture point.
start Starts the Wireshark session and captures live traffic.
capture-filter filter-string Specifies the capture filter.
display [display-filter filter-string] Decodes and displays the filter. Optionally, specifies the display
filter.
[brief | detailed | dump] Specifies the display mode. Default is brief.
stop Stops the Wireshark session.