Administrator Guide

saved file. The maximum file size for a TCP dump capture is 1MB. When a file reaches 1MB, a new file is
created, up to the specified total number of files.
Maximize the number of packets recorded in a file by specifying the snap-length to capture the file
headers only.
The tcpdump command has a finite run process. When you enable the command, it runs until the
capture-duration timer and/or the packet-count counter threshold is met. If you do not set a threshold,
the system uses a default of 5 minute capture-duration and/or a single 1k file as the stopping point for
the dump.
You can use the capture-duration timer and the packet-count counter at the same time. The TCP dump
stops when the first of the thresholds are met. That means that even if the duration timer is 9000
seconds, if the maximum file count parameter is met first, the dumps stop.
• Enable a TCP dump for CPU bound traffic.
CONFIGURATION mode
tcpdump cp [capture-duration time | filter expression | max-file-count value
| packet-count value | snap-length value | write-to path]
928
Z-Series Debugging and Diagnostics