Cisco Catalyst 4500 Series, Руководство по настройке программного обеспечения, Страница: 1736 / 2086

68-4
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 68 Configuring Wireshark
Restrictions for Wireshark
If you need to use access list or class-map in the Wireshark CLI, you must define an access list and
class map with configuration commands.
• No specific order applies when defining a capture point; you can define capture point parameters in
any order, provided that CLI allows this. The Wireshark CLI allows as many parameters as possible
on a single line. This limits the number of commands required to define a capture point.
•
All parameters except attachment points take a single value. Generally, you can replace the value
with a new one by reentering the command. After user confirmation, the system accepts the new
value and overrides the older one. A
no form of the command is unnecessary to provide a new value;
it is necessary to remove a parameter.
• Wireshark allows you to specify one or more attachment points. To add more than one attachment
point, reenter the command with the new attachment point. To remove an attachment point, use the
no form. You can specify an interface range as an attachment point.
For example, monitor capture mycap int gi 3/1 in , where interface gi 3/1 is an attachment point.
If you also need to attach gi 3/2, you specify it in another line, as follows:
monitor capture mycap int gi 3/2 in
• You cannot modify any parameters of a capture point while a session is active. To modify any
parameter, stop the session, make the changes, and restart the session. Because an access list is
generic to a switch and unrelated to the Wireshark process, it is alterable during a Wireshark session.
•
The action you want to perform determines which parameters are mandatory. The Wireshark CLI
allows you to specify or modify any parameter prior to entering the
start command. When you issue
the start command, Wireshark will start only after determining that all mandatory parameters have
been provided.
• If the capture file already exists, it provides a warning and receives confirmation before
proceeding.This prevents you from mistakenly overwriting a file.
•
The core filter can be an explicit filter, access list, or class map. Specifying a newer filter of these
types replaces the existing one.
• You can terminate a Wireshark session with an explicit stop command or by entering q in automore
mode. The session could terminate itself automatically when a stop condition such as duration or
packet capture limit is met.
Restrictions for Wireshark
• The CLI for configuring Wireshark requires that the feature be executed only from EXEC mode.
Actions that usually occur in configuration submode (such as defining capture points), are handled
at the EXEC mode instead. All key commands are not NVGEN’d and are not synchronized to the
standby supervisor in NSF and SSO scenarios.
•
When packet capture is enabled in the input direction, the matching packets undergo software-based
lookup in the CPU for the first 15 seconds. During this time, CPU usage is high and capture rate is
low.
• Packets captured in the output direction of an interface might not reflect the changes made by switch
rewrite (includes TTL, VLAN tag, CoS, checksum, and MAC addresses).
•
Capturing at a physical port that belongs to another logical port may not be supported. For example,
capturing at EtherChannel member ports is not supported.
• Limiting circular file storage by file size is not supported.