305
Configuring the packet capture
Overview
The packet capture feature captures incoming packets that are to be forwarded in CPU. The feature
displays the captured packets in real time, and allows you to save the captured packets to a .pcap file
for future analysis.
The packet capture supports capture filters and display filters. You can use expressions to match
packets to capture or display.
Packet capture modes
The device supports the following packet capture modes: local packet capture, remote packet
capture, and feature image-based packet capture.
Local packet capture
Local packet capture displays the captured packets at the CLI or saves the captured packets to a
remote file on an FTP server or to a local file.
Remote packet capture
Remote packet capture sends captured packets to the Wireshark packet analyzer installed on a PC.
Before using remote packet capture, you must install the Wireshark software on a PC and connect
the PC to the device.
Feature image-based packet capture
Feature image-based packet capture saves the captured packets to a local file or displays the
captured packets on the terminal. This mode can also display contents of .pcap and .pcapng files.
To use this mode, you must install the packet capture feature image by using the
boot-loader
,
install
, or
issu
command. For more information about image installation, see software upgrade or
ISSU in
Fundamentals Configuration Guide
.
Only feature image-based packet capture requires the packet feature image, but uninstalling the
image also uninstalls remote packet capture and local packet capture.
Filter elements
A capture or display filter contains a keyword string or multiple keyword strings that are connected by
operators.
Keywords include the following types:
•
Qualifiers
—Fixed keyword strings. For example, you must use the
ip
qualifier to specify the
IPv4 protocol.
•
Variables
—Values supplied by users in the required format. For example, you can set an IP
address to 2.2.2.2 or any other valid values.
A variable must be modified by one or multiple qualifiers. For example, to capture any packets sent
from the host at 2.2.2.2, use the filter
src host 2.2.2.2
.
Operators include the following types:
•
Logical operators
—
Perform logical operations, such as the AND operation.
•
Arithmetic operators
—
Perform arithmetic operations, such as the ADD operation.
