No specific order applies when defining a capture point; you can define capture point parameters in any order.
The Wireshark CLI allows as many parameters as possible on a single line. This limits the number of commands
required to define a capture point.
Neither VRFs, management ports, nor private VLANs can be used as attachment points.
Wireshark cannot capture packets on a destination SPAN port.
When a VLAN is used as a Wireshark attachment point, packets are captured in the input direction only.
Examples
To define a capture point using a physical interface as an attachment point:
Device#
monitor capture mycap interface GigabitEthernet1/0/1 in
Device#
monitor capture mycap match ipv4 any any
The second command defines the core filter for the capture point. This is required for a functioning capture
point unless you are using a CAPWAP tunneling attachment point in your capture point.
If you are using CAPWAP tunneling attachment points in your capture point, you cannot use core filters.
Note
To define a capture point with multiple attachment points:
Device#
monitor capture mycap interface GigabitEthernet1/0/1 in
Device#
monitor capture mycap match ipv4 any any
Device#
monitor capture mycap control-plane in
Device#
show monitor capture mycap parameter
monitor capture mycap interface GigabitEthernet1/0/1 in
monitor capture mycap control-plane in
To remove an attachment point from a capture point defined with multiple attachment points:
Device#
show monitor capture mycap parameter
monitor capture mycap interface GigabitEthernet1/0/1 in
monitor capture mycap control-plane in
Device#
no monitor capture mycap control-plane
Device#
show monitor capture mycap parameter
monitor capture mycap interface GigabitEthernet1/0/1 in
To define a capture point with a CAPWAP attachment point:
Device#
show capwap summary
CAPWAP Tunnels General Statistics:
Number of Capwap Data Tunnels
= 1
Number of Capwap Mobility Tunnels
= 0
Number of Capwap Multicast Tunnels
= 0
Name
APName
Type PhyPortIf Mode
McastIf
------ -------------------------------- ---- --------- --------- -------
Ca0
AP442b.03a9.6715
data Gi3/0/6
unicast
-
Name
SrcIP
SrcPort DestIP
DstPort DtlsEn MTU
Xact
------ --------------- ------- --------------- ------- ------ ----- ----
Ca0
10.10.14.32
5247
10.10.14.2
38514
No
1449
0
Device#
monitor capture mycap interface capwap 0 both
Device#
monitor capture mycap file location flash:mycap.pcap
Device#
monitor capture mycap file buffer-size 1
Device#
monitor capture mycap start
*Aug 20 11:02:21.983: %BUFCAP-6-ENABLE: Capture Point mycap enabled.on
Device#
show monitor capture mycap parameter
monitor capture mycap interface capwap
0 in
monitor capture mycap interface capwap
0 out
Command Reference, Cisco IOS XE Everest 16.5.1a (Catalyst 3650 Switches)
491
monitor capture (interface/control plane)
Summary of Contents for Catalyst 3650 Series
Page 2: ... 2017 Cisco Systems Inc All rights reserved ...
Page 37: ...P A R T I Campus Fabric Campus Fabric page 13 ...
Page 38: ......
Page 51: ...P A R T II Interface and Hardware Components Interface and Hardware Commands page 27 ...
Page 52: ......
Page 165: ...P A R T III IP IP page 141 ...
Page 166: ......
Page 235: ...P A R T IV IP Multicast Routing IP Multicast Routing page 211 ...
Page 236: ......
Page 303: ...P A R T V IPv6 IPv6 page 279 ...
Page 304: ......
Page 307: ...P A R T VI Layer 2 3 Layer 2 3 page 283 ...
Page 308: ......
Page 399: ...P A R T VII Multiprotocol Label Switching MPLS MPLS page 375 Multicast VPN page 385 ...
Page 400: ......
Page 429: ...P A R T VIII Network Management Flexible NetFlow page 405 Network Management page 479 ...
Page 430: ......
Page 595: ...P A R T IX Programmability Programmability page 571 ...
Page 596: ......
Page 624: ...Command Reference Cisco IOS XE Everest 16 5 1a Catalyst 3650 Switches 598 ping6 ...
Page 625: ...P A R T X QoS Auto QoS page 601 QoS page 641 ...
Page 626: ......
Page 666: ...Command Reference Cisco IOS XE Everest 16 5 1a Catalyst 3650 Switches 640 show auto qos ...
Page 706: ...Command Reference Cisco IOS XE Everest 16 5 1a Catalyst 3650 Switches 680 trust device ...
Page 707: ...P A R T XI Routing Bidirectional Forwarding Detection page 683 ...
Page 708: ......
Page 725: ...P A R T XII Security Security page 701 ...
Page 726: ......
Page 875: ...P A R T XIII Stack Manager and High Availability Stack Manager and High Availability page 851 ...
Page 876: ......
Page 912: ......
Page 1027: ...P A R T XV VLAN VLAN page 1003 ...
Page 1028: ......
Page 1100: ...Command Reference Cisco IOS XE Everest 16 5 1a Catalyst 3650 Switches 1074 vtp primary ...
Page 1102: ...Command Reference Cisco IOS XE Everest 16 5 1a Catalyst 3650 Switches 1076 Notices ...
Page 1108: ...Command Reference Cisco IOS XE Everest 16 5 1a Catalyst 3650 Switches IN 6 Index ...