WIXLIB

Cisco IOS Embedded Packet Capture Command ReferenceAmericas HeadquartersCisco Systems, Inc.170 West Tasman DriveSan Jose, CA 95134-1706USAhttp://www.cisco.comTel: 408 526-4000800 553-NETS (6387)Fax: 408 527-0883

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITHTHE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain versionof the UNIX operating system. All rights reserved. Copyright 1981, Regents of the University of California.NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OFMERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUTLIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERSHAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, networktopology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentionaland coincidental.Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: https://www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnershiprelationship between Cisco and any other company. (1721R) 2018Cisco Systems, Inc. All rights reserved.

CONTENTSCHAPTER 1monitor capture through show monitor capture 1monitor capture 2monitor capture (access list/class map) 6monitor capture (interface/control plane) 8monitor capture buffer 10monitor capture clear 13monitor capture export 14monitor capture match 15monitor capture limit 18monitor capture point 20monitor capture point associate 22monitor capture point disassociate 24monitor capture point start 26monitor capture point stop 28monitor capture point tcp 29monitor capture point udp 31monitor capture start 33monitor capture stop 34show monitor capture 35Cisco IOS Embedded Packet Capture Command Referenceiii

ContentsCisco IOS Embedded Packet Capture Command Referenceiv

monitor capture through show monitor capture monitor capture, page 2 monitor capture (access list/class map), page 6 monitor capture (interface/control plane), page 8 monitor capture buffer, page 10 monitor capture clear, page 13 monitor capture export, page 14 monitor capture match, page 15 monitor capture limit, page 18 monitor capture point, page 20 monitor capture point associate, page 22 monitor capture point disassociate, page 24 monitor capture point start, page 26 monitor capture point stop, page 28 monitor capture point tcp, page 29 monitor capture point udp, page 31 monitor capture start, page 33 monitor capture stop, page 34 show monitor capture, page 35Cisco IOS Embedded Packet Capture Command Reference1

monitor capture through show monitor capturemonitor capturemonitor captureTo enable and configure monitor packet capturing, use the the monitor capture privileged EXEC modecommand. To disable monitor packet capturing, use the no form of this command.monitor capture [buffer size size] [circular linear] [dot1q] [filter acl-num exp-acl-num acl-name] [lengthbytes] {clear [filter] export buffer location schedule at hh : mm : ss [date [month year]] start [for number{seconds packets}] stop}no monitor capture [buffer size size] [circular linear] [dot1q] [filter acl-num exp-acl-num acl-name][length bytes] [clear [filter] export buffer location schedule at hh : mm : ss [date [month year]]]Syntax Descriptionbuffer size sizeSpecifies the capture buffer size in kilobytes. Range:32 to 65535. Default: 2048 Kb.circular linearSpecifies a circular or linear capture buffer. Thedefault is linear.clearClears the capture buffer and sets the number ofcaptured packets to zero.dot1qIncludes dot1q information in the monitor capturing.export bufferExports to remote location.filterSpecifies that packets from a specified ACLs onlyare sent to the capture buffer.acl-numIP access list (standard or extended). Range: 1 to 199.exp-acl-numIP expanded access list (standard or extended). Range:1300 to 2699.acl-nameACL name.lengthsizeCisco IOS Embedded Packet Capture Command Reference2Specifies the capture length of each packet in bytes.Range: 0 to 9216. Default: 68.

monitor capture through show monitor capturemonitor capturelocationLocation to dump capture buffer. Valid values are asfollows: dot1q location --Specifies the dot1q capturebuffer location. bootflash: --Location to dump buffer. disk0: --Location to dump buffer. ftp: --Location to dump buffer. http: --Location to dump buffer. https: --Location to dump buffer. rcp: --Location to dump buffer. scp: --Location to dump buffer. sup-bootdisk: --Location to dump buffer. tftp: --Location to dump buffer.schedule atSchedules the capture at a specific time/date.hh : mm : ssTime in hours:minutes:seconds. Range: hours: 0 to23; minutes: 0 to 59; seconds: 0 to 59.date(Optional) Date. Range: 1 to 31.month(Optional) Month. Range: 1 to 12.startStarts capturing the packets to the beginning of thebuffer.for(Optional) Specifies the length of time in seconds orthe number of packets.numberStops the capture after the specified number ofseconds or packets. Range: 1 to 4294967295.stopMoves the capture to the OFF state.Command DefaultCapture buffer is disabled by default.Command ModesEXEC ( )Cisco IOS Embedded Packet Capture Command Reference3

monitor capture through show monitor capturemonitor captureCommand HistoryUsage GuidelinesReleaseModification12.2(33)SXIThis command was introduced.The buffer size size keywords and argument defines the buffer size that is used to store the packet.The length size keyword and argument copies the specified number of bytes of data from each packet. Thedefault setting of 68 bytes is adequate for IP, ICMP, TCP, and UDP. If you set the length to 0, the wholepacket is copied to the buffer.The linear capture buffer mode specifies that capture stops when the end of the capture buffer is reached. Inthe circular capture buffer mode, the capture will begin to overwrite earlier entries when the capture bufferbecomes full. Changing the buffer mode or the buffer length automatically stops the capture.If the ACL specified is configured, it is used for applying the filter in the software. When you specify a capturefilter ACL in the start command, the new ACL will not override any configured ACLs. The new ACL willexecute in software.If you configure the capture schedule, the capture schedule stops the capture start for the specified future time.This is the same as manually starting a capture at the specified time. If any capture is already running, thatcapture is stopped and the buffer is cleared.The format for time and date is hh:mm:ss dd mmm yyyy. The time zone is GMT. The hour is specified in24-hour notation, and the month is specified by a three-letter abbreviation. For example, to set a capturestarting time of 7:30 pm on October 31, 2008, use the notation 19:30:00 31 oct 2008.If you do not enter the start or stop keyword, the capture buffer is initialized and set in the OFF state.If you enter the no monitor capture command without entering any keywords or arguments, capture is stoppedand the capture buffer is deleted. After entering the no form of the monitor capture command, the capturebuffer cannot be displayed or exported. If you specify the length or buffer size with the no monitor capturecommand, the capture is not deleted and the length or buffer size is set to the default values. The start andstop keywords are not valid with the no monitor capture command.To clear the EXEC configurations or any capture schedules, enter the clear keyword. The clear keywordclears the capture buffer and sets the number of captured packets to zero.ExamplesThis example shows how to configure the capture length initially before starting the capture:Router# monitor capture length 128Router# monitor capture startRouter# monitor capture stopThis example shows how to start a new capture with non-default values:Router# monitor capture length 100 circular startRouter# monitor capture stopRelated CommandsCommandDescriptionshow monitor captureDisplays the capture buffer contents.Cisco IOS Embedded Packet Capture Command Reference4

monitor capture through show monitor capturemonitor captureCisco IOS Embedded Packet Capture Command Reference5

monitor capture through show monitor capturemonitor capture (access list/class map)monitor capture (access list/class map)To configure a monitor capture specifying an access list or a class map as the core filter for the packet capture,use the monitor capture command in privileged EXEC mode. To disable the monitor capture with thespecified access list or class map as the core filter, use the no form of this command.monitor capture capture-name {access-list access-list-name class-map class-map-name}no monitor capture capture-name {access-list access-list-name class-map class-map-name}Syntax Descriptioncapture-nameThe name of the capture.access-list access-list-nameConfigures an access list with the specified name.class-map class-map-nameConfigures a class map with the specified name.Command DefaultA monitor capture with the specified access list or a class map as the core filter for the packet capture is notconfigured.Command ModesPrivileged EXEC (#)Command HistoryReleaseModificationCisco IOS XE Release 3.7SThis command was introduced.Usage GuidelinesConfigure the access list using the ip access-list command or the class map using the class-map commandbefore using the monitor capture command. You can specify a class map, or an access list, or an explicitinline filter as the core filter. If you have already specified the filter when you entered the monitor capturematch command, the command replaces the existing filter.ExamplesThe following example shows how to define a core system filter using an existing access control list:Device enableDevice# configure terminalDevice(config)# ip access-list standard acl1Device(config-std-nacl)# permit anyDevice(config-std-nacl)# exitDevice(config)# exitDevice# monitor capture mycap access-list acl1Device# endThe following example shows how to define a core system filter using an existing class map:Device enableDevice# configure terminalDevice(config)# ip access-list standard acl1Cisco IOS Embedded Packet Capture Command Reference6