Administrator Guide

Version Description
8.3.19.0 Introduced on the S4820T.
8.3.11.1 Introduced on the Z9000.
8.3.7.0 Introduced on the S4810.
Usage
Information
Use the tcpdump command to perform a packet capture on a specified switch CPU: Control Processor
(CP) or Route Processor (RP).
You can use the capture-duration timer and the packet-count counter at the same time. The TCP dump
stops when the first of the thresholds is met. That means that even if the duration timer is 9000 seconds,
if the maximum file count parameter is met first, the dumps stop.
The files saved on the flash are located in the flash://TCP_DUMP_DIR/Tcpdump_<time_stamp_dir>/
directory. The file name is tcpdump_*.pcap. There can be up to 20 Tcpdump_<time_stamp_dir>
directories. If more than 20 files are created, the oldest is overwritten.
Entering the no tcpdump command stops any TCP dump process running in either the Control
Processor or Route Processor. The dump stops immediately, without waiting for a threshold to be met.
To stop the TCP dump process running in the CP processor, enter the no tcpdump cp command; to
stop the TCP dump process running in the RP processor, enter the no tcpdump rp command.
Debugging and Diagnostics 617