Cisco Catalyst 4500 Series, Software Configuration Manual

Page: 1734 / 2086

68-2
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 68 Configuring Wireshark
Prerequisites for Wireshark
Use Cisco Feature Navigator to find information about platform support and Cisco software image
support. To access Cisco Feature Navigator, go to
http://www.cisco.com/go/cfn
An account on Cisco.com is not required.
Prerequisites for Wireshark
For general packet filtering, you will require Wireshark display filters. Refer to
http://wiki.wireshark.org/DisplayFilters
Guidelines for Wireshark
• During Wireshark packet capture, hardware forwarding happens concurrently.
•
Before starting a Wireshark capture process, ensure that CPU usage is moderate and that sufficient
memory (at least 200 MB) is available.
• If you plan to store packets to a storage file, ensure that sufficient space is available before beginning
a Wireshark capture process.
•
The CPU usage during Wireshark capture depends on how many packets match the specified
conditions and on the intended actions for the matched packets (store, decode and display, or both).
• Where possible, keep the capture to the minimum (limit by packets, duration) to avoid high CPU
usage and other undesirable conditions.
•
Because packet forwarding typically occurs in hardware, packets are not copied to the CPU for
software processing. For Wireshark packet capture, packets are copied and delivered to the CPU,
which causes an increase in CPU usage.
To avoid high CPU, do the following:
–
Attach only relevant ports.
– Use a class map, and secondarily, an access list to express match conditions. If neither is viable,
use an explicit, in-line filter.
–
Adhere closely to the filter rules. Restrict the traffic type (such as, IPv4 only) with a restrictive,
rather than relaxed ACL, which elicits unwanted traffic.
• Always limit packet capture to either a shorter duration or a smaller packet number. The parameters
of the
capture command enable you to specify the following:
–
Capture duration
– Number of packets captured
–
File size
– Packet segment size
•
Run a capture session without limits if you know that very little traffic matches the core filter.
• You might experience high CPU (or memory usage) if:
–
You leave a capture session enabled and unattended for a long period of time, resulting in
unanticipated bursts of traffic.