Command Reference Guide

Serviceability Packet Tracing Commands
CLI Command Reference
September 2014 Page 218
HP Moonshot Switch Module CLI Command Reference
capture stop
Use the command capture stop to manually stop capturing CPU packets for packet trace.
capture file|remote|line
Use this command to configure file capture options. The command is persistent across a reboot cycle.
Format
capture stop
Mode Privileged EXEC
Format
capture {file|remote|line}
Mode Global Config
Parameter Description
file In the capture file mode, the captured packets are stored in a file on NVRAM. The maximum
file size defaults to 524288 bytes. The switch can transfer the file to a TFTP server via TFTP,
SFTP, SCP via CLI, and SNMP.
The file is formatted in pcap format, is named cpuPktCapture.pcap, and can be examined
using network analyzer tools such as Wireshark® or Ethereal®. Starting a file capture
automatically terminates any remote capture sessions and line capturing. After the packet
capture is activated, the capture proceeds until the capture file reaches its maximum size,
or until the capture is stopped manually using the CLI command capture stop.
remote In the remote capture mode, the captured packets are redirected in real time to an external
PC running the Wireshark tool for Microsoft® Windows®. A packet capture server runs on
the switch side and sends the captured packets via a TCP connection to the Wireshark tool.
The remote capture can be enabled or disabled using the CLI. There should be a Windows
PC with the Wireshark tool to display the captured file. When using the remote capture
mode, the switch does not store any captured data locally on its file system.
You can configure the IP port number for connecting Wireshark to the switch. The default
port number is 2002. If a firewall is installed between the Wireshark PC and the switch,
then these ports must be allowed to pass through the firewall. You must configure the
firewall to allow the Wireshark PC to initiate TCP connections to the switch.
If the client successfully connects to the switch, the CPU packets are sent to the client PC,
then Wireshark receives the packets and displays them. This continues until the session is
terminated by either end.
Starting a remote capture session automatically terminates the file capture and line
capturing.
line In the capture line mode, the captured packets are saved into the RAM and can be
displayed on the CLI. Starting a line capture automatically terminates any remote capture
session and capturing into a file. There is a maximum 128 packets of maximum 128 bytes
that can be captured and displayed in line mode.