|
file
|
In the capture file mode, the captured packets are stored in a file on NVRAM. The maximum file size defaults to 524288 bytes. The switch
can transfer the file to a TFTP server via TFTP, SFTP, SCP via CLI, and SNMP.
The file is formatted in pcap format, is named cpuPktCapture.pcap, and can be examined using network analyzer tools such as
Wireshark or Ethereal. Starting a file capture automatically terminates any remote capture sessions and line capturing.
After the packet capture is activated, the capture proceeds until the capture file reaches its maximum size, or until the
capture is stopped manually using the CLI command capture stop.
|
|
remote
|
In the remote capture mode, the captured packets are redirected in real time to an external PC running the Wireshark
tool for Microsoft Windows. A packet capture server runs on the switch side and sends the captured packets via a TCP
connection to the Wireshark tool.
The remote capture can be enabled or disabled using the CLI. There should be a Windows PC with the Wireshark tool to
display the captured file. When using the remote capture mode, the switch does not store any captured data locally on its
file system.
You can configure the IP port number for connecting Wireshark to the switch. The default port number is 2002. If a firewall
is installed between the Wireshark PC and the switch, then these ports must be allowed to pass through the firewall. You
must configure the firewall to allow the Wireshark PC to initiate TCP connections to the switch.
If the client successfully connects to the switch, the CPU packets are sent to the client PC, then Wireshark receives the
packets and displays them. This continues until the session is terminated by either end.
Starting a remote capture session automatically terminates the file capture and line capturing.
|
|
line
|
In the capture line mode, the captured packets are saved into the RAM and can be displayed on the CLI. Starting a line
capture automatically terminates any remote capture session and capturing into a file. There is a maximum 128 packets of
maximum 128 bytes that can be captured and displayed in line mode.
|
