Purpose
Activate packet trace capture.
Syntax
packet-capture start interface
filename duration filesize [ ring-buffer-number ]
["filter "]
Parameters
- interface
- Network interface
name, such as eth0
- filename
- Output trace file name. If ring-buffer-number is
also specified, an index number is appended to the filename.
- duration
- Packet
capture duration, in seconds. A value of 0 indicates
the packet capture should continue until the packet-capture
stop command is issued.
- filesize
- Size of trace file, in megabytes (MB). The value must be from
0 through 100.
- ring-buffer-number
- If specified, enables ring buffer function and sets number of
ring buffer files. The value must be from 0 through 10.
- filter
- Filter to use in selecting
captured packets, within double quotation
marks (\" \"). An extensive filter capability is supported, including,
for example, filtering on packet source, destination, ports, and protocols.
Search the internet for pcap-filter for complete details on supported
filter syntax.
Usage Notes
- In
order to start a packet capture on an interface, the following
conditions are required:
- The interface must be active.
- No
other packet captures can be active for the interface.
- If
tracing is required for an aggregate-interface, start the trace
on the aggregate-interface itself. A packet capture on a member link
may not contain complete data.
- Any files from a previous
packet capture must be cleared by using
the packet-capture clear command.
- Packet
capture stops when any of the following condition occurs:
- The file size limitation is reached, if the ring-buffer function
is not used.
- The packet capture duration ends.
- The packet-capture
stop command is issued.
- Output
trace files can be analyzed with commercial off-the-shelf
tools that can read data in libpcap format, such as Wireshark.
Example
Start a packet capture on interface
eth1 for
60 seconds. Allow the trace files to grow to a maximum of 10 MB. Write
the packet capture to two ring buffer files named
pc11 and
pc12.
Console> packet-capture start eth1 pc1 60 10 2 "icmp"
Packet capture started on eth1
Ok
Console>