Dell N3200-ON Networking N-Series Switches CLI Reference Guide version 6.8.0 - Page 718

User Guidelines Packets that are transmitted or received by the switch CPU may be captured to the switch file system, to local memory, or sent to a WireShark client. Packets captured to the switch file system are stored in pcap format and may be copied from the system and opened with WireShark or TShark or other utilities. Packets sent to the console are written in ASCII hex format. When WireShark is configured and connected to the switch, packet capture is controlled by WireShark. See the Users Configuration Guide for an example of how to configure WireShark for packet capture. Changes to configuration take effect on the next execution of the monitor capture start command. Only one of file, remote, or line may be specified. Setting the file, remote, or line stops the capture. No monitor capture file size returns the capture file size to the defaults No monitor capture remote port returns the TCP port to the default The administrator can capture packets into one of the following locations: memory, switch NVRAM, or directly to a Wireshark analyzer. Example Configure capture for Wireshark remote access on port 2020: console(config)#monitor capture remote port 2020 console(config)#monitor capture mode remote console(config)#exit console#monitor capture start Copy the local capture file to a TFTP server console#copy flash://cpuPktCapture.pcap tftp://10.267.9.99/mypkts.pcap monitor capture (Privileged Exec) Use the monitor capture command to capture packets transmitted or received from the CPU. This facility captures switch control plane traffic and is useful in monitoring network control traffic and analyzing network security. Remote packet capture is not supported when the packets are received via Service Port. Layer 2 Switching Commands 718