Cisco Catalyst 4500 Series, Software Configuration Manual

Page: 1746 / 2086

68-14
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 68 Configuring Wireshark
Monitoring Wireshark
Activating and Deactivating a Capture Point
A capture point cannot be activated unless an attachment point and a core system filter have been defined
and the associated filename (if any) does not already exist. A capture point with no associated filename
can only be activated to display. If no capture or display filters are specified, all of the packets captured
by the core system filter are displayed. The default display mode is
brief .
To activate or deactivate a capture point, perform these tasks:
Configuring Wireshark on VSS
To configure Wireshark in the VSS standby switch, use the remote login command:
Switch_VSS# remote login module 11
Connecting to standby virtual console
Type "exit" or "quit" to end this session
Switch_VSS-standby-console# monitor capture mycap match any interface gi2/1/1 in file
location bootflash:text.pcap
Monitoring Wireshark
The commands in the following table are used to monitor Wireshark.
Command Purpose
monitor capture name start [ capture-filter filter-string ]
[ display [ display-filter filter-string ]] [ brief | detailed |
dump ]
monitor capture name stop
Example:
Switch# monitor capture mycap start capture-filter
"net 10.1.1.0 0.0.0.255 and port 80"
Switch# monitor capture mycap start display
display-filter "net 10.1.1.0 0.0.0.255 and port
80"
Activates a capture point.
Deactivates a capture point.
Table 68-2 Wireshark Monitoring Commands
Command Purpose
show monitor capture point name
Displays the capture point state so that you can see what capture points
are defined, what their attributes are, and whether they are active. When
capture point
name is specified, it displays specific capture point's
details.
show monitor capture file name
[
display-filter
filter-string ] [
brief
|
detailed | dump ]
Activates Wireshark using an existing .pcap file as the source for
packets. If no display filter is specified, all of the packets in the file are
displayed. The default display mode is
brief .