Chapter 68
Configuring Wireshark
Launch a capture session with the buffer capture option by entering:
Step 1
Switch# monitor capture mycap interface gi 3/1 in
Switch# monitor capture mycap match ipv4 any any
Switch# monitor capture mycap buffer circular size 1
Switch# monitor capture mycap start
Step 2
Determine whether the capture is active by entering:
Switch# show monitor capture mycap
Status Information for Capture mycap
Target Type:
Interface: GigabitEthernet3/1, Direction: in
Status : Active
Filter Details:
IPv4
Source IP:
Destination IP:
Protocol: any
File Details:
File not associated
Buffer Details:
Buffer Type: CIRCULAR
Buffer Size (in MB): 1
Limit Details:
limit not set
Display the packets in the buffer by entering:
Step 3
Switch# show monitor capture mycap buffer brief
0.000000
1.000000
2.000000
3.000000
4.000000
5.000000
6.000000
7.000000
8.000000
9.000000
10.000000
11.000000
12.000000
13.000000
14.000000
15.000000
16.000000
17.000000
18.000000
19.000000
20.000000
21.000000
Notice that the packets have been buffered.
Display the packets in other display modes.
Step 4
Switch# show monitor capture mycap buffer detailed
Frame 1: 256 bytes on wire (2048 bits), 256 bytes captured (2048 bits)
Arrival Time: Apr 15, 2012 15:50:02.398966000 PDT
Epoch Time: 1334530202.398966000 seconds
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
any
any
10.1.1.215 -> 20.1.1.2
10.1.1.216 -> 20.1.1.2
10.1.1.217 -> 20.1.1.2
10.1.1.218 -> 20.1.1.2
10.1.1.219 -> 20.1.1.2
10.1.1.220 -> 20.1.1.2
10.1.1.221 -> 20.1.1.2
10.1.1.222 -> 20.1.1.2
10.1.1.223 -> 20.1.1.2
10.1.1.224 -> 20.1.1.2
10.1.1.225 -> 20.1.1.2
10.1.1.226 -> 20.1.1.2
10.1.1.227 -> 20.1.1.2
10.1.1.228 -> 20.1.1.2
10.1.1.229 -> 20.1.1.2
10.1.1.230 -> 20.1.1.2
10.1.1.231 -> 20.1.1.2
10.1.1.232 -> 20.1.1.2
10.1.1.233 -> 20.1.1.2
10.1.1.234 -> 20.1.1.2
10.1.1.235 -> 20.1.1.2
10.1.1.236 -> 20.1.1.2
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
Usage Examples for Wireshark
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
Destination port: 20002
68-21