Administrator Guide

Layer 2 Switching Commands 647
Syntax
monitor capture mode {line | remote | file}
no monitor capture mode
• line— Captured packets are sent to the console.
• remote— Captured packets are sent to a remote WireShark network
analyzer.
• file— Captured packets are sent to the file system.
Default Configuration
By default, remote capture is configured.
Command Modes
Global Configuration mode
User Guidelines
Only one file, remote, or line may be specified. Setting the mode takes effect
immediately.
Use the monitor capture start command to start the capture.
Memory Capture:
Captured packets can be displayed on the console using the show monitor
capture packets command. Captured packets can be displayed when actively
capturing or when stopped. When a capture session is active, it is possible to
display only the captured packets which were not previously displayed as the
show command empties the capture buffer. When a capture session is
stopped, it is possible to display all saved packets as often as required. The
command show monitor capture packets always displays the captured packets
in chronological order.
The memory buffer only stores the first 128 bytes of each packet captured.
The switch displays the following information from the captured packet when
it is displayed on CLI:
• Packet is transmitted or received.
• ID of interface through which the packet was passed.