Concept Guide

The tcpdump command has a nite run process. When you enable the tcpdump command, it runs until the capture-duration timer and/or
the packet-count counter threshold is met. If you do not set a threshold, the system uses a default of a 5 minute capture-duration and/or a
single 1k le as the stopping point for the dump.
You can use the capture-duration timer and the packet-count counter at the same time. The TCP dump stops when the rst of the
thresholds is met. That means that even if the duration timer is 9000 seconds, if the maximum le count parameter is met rst, the dumps
stop.
To enable a TCP dump, use the following command.
• Enable a TCP dump for CPU bound trac.
CONFIGURATION mode
tcpdump cp [capture-duration time | filter expression | max-file-count value | packet-count
value | snap-length value | write-to path]
Debugging and Diagnostics 1175