Command Line Reference Guide

filter Specify the packet that will be dumped. If no filter is entered,
all packets are dumped. Filter expressions usually consist of
an id (name or number) preceded by one or more qualifiers.
There are three different kinds of qualifier: type, direction, or
protocol.
Enclose the filter option with double quotes: “port 20.” The
range is 1 to 100 characters.
packet-count Enter the number of packets to capture. The counter begins
as soon as the command is enabled. The range is 10 to
150000.
snap-length Enter the number of bytes per packet to capture. Use this
option to reduce the size of the captured packets, to capture
only the needed headers and avoid rest of the data portion
of the packet. The range is 0 to 1200.
write-to Enter the location to save the captured packets. Files can be
saved to flash, to FTP, SCP, or TFTP:
• flash://filepath
• ftp://userid:password@hostip/filepath
• scp://userid:password@hostip/filepath
• tftp://hostip/filepath
Defaults Disable
Command
Modes
EXEC Privilege
Command
History
Version 9.0.2.0 Introduced on the S6000.
Version 8.3.11.1 Introduced on the Z9000.
Usage
Information
You can use the capture-duration timer and the packet-count counter at the same
time. The TCP dump stops when the first of the thresholds is met. That means that
even if the duration timer is 9000 seconds, if the maximum file count parameter is
met first, the dumps stop.
Entering no tcpdump stops the file dump immediately, without waiting for a
threshold to be met.
The files saved on the flash are located in the flash://TCP_DUMP_DIR/
Tcpdump_<time_stamp_dir>/directory. The file name is tcpdump_*.pcap. There
can be up to 20 Tcpdump_<time_stamp_dir> directories. If more than 20 files are
created, the oldest is overwritten.
Debugging and Diagnostics
505