Cisco Catalyst 3650 Series, Command Reference Manual

Page: 522 / 1108

monitor capture export
To export a monitor capture (WireShark) to a file, use the monitor capture export command in privileged
EXEC mode.
monitor capture
{ capture-name }
export file-location
: file-name
Syntax Description
The name of the capture to be exported. capture-name
(Optional) Specifies the location and file name of the capture storage file.
Acceptable values for
file-location :
• flash — On-board flash storage
•
(usbflash0:)
—
USB drive
file-location : file-name
Command Default
The captured packets are not stored.
Command Modes
Privileged EXEC
Command History
Modification Release
This command was introduced. Cisco IOS XE 3.3SE
Usage Guidelines
Use the monitor capture export command only when the storage destination is a capture buffer. The file
may be stored either remotely or locally. Use this command either during capture or after the packet capture
has stopped. The packet capture is stopped when one or more end conditions have been met or you entered
the
monitor capture stop command.
When WireShark is used on switches in a stack, packet captures can be stored only on the devices specified
for
file-location above that are connected to the active switch. Example: flash1 is connected to the active
switch. flash2 is connected to the secondary switch. Only flash1 can be used to store packet captures.
Attempts to store packet captures on unsupported devices or devices not connected to the active switch
will probably result in errors. Note
Examples To export the capture buffer contents to mycap.pcap on a flash drive:
Device# monitor capture mycap export flash:mycap.pcap
Command Reference, Cisco IOS XE Everest 16.5.1a (Catalyst 3650 Switches)
496
monitor capture export