Dell N3200-ON EMC Networking N-Series Switches CLI Reference Guide version 6.7 - Page 716

If capturing is in progress, the show monitor capture packets command displays only the captured packets that have not yet been displayed during the capturing session. If capturing is stopped, the first (after stopping) show monitor capture packets command displays the packets that have not yet been displayed during the capturing session. The next show monitor capture packets command displays up to 128 captured packets. If the capturing session is stopped automatically when the packet display is in progress, then packet display continues until all packets are shown. The next call of the show capture packets command displays nothing. Please note that such behavior is observed only if the capturing session is stopped automatically when the packet display is in progress. NVRAM Capture: After packet capture is activated, packets are stored in NVRAM until the capture file reaches its maximum size, or until the capture is stopped manually. When the capture is started the capture file from the previous capture is deleted. The captured file can be uploaded via TFTP, SFTP, SCP via CLI, and SNMP using the copy command. The name of the capture file is cpuPktCapture.pcap. Remote Capture: Remote Packet Capture works with the Wireshark network analyzer tool. A packet capture server runs on the switch and sends the captured packets via a TCP connection to the Wireshark tool. Once a connection is established, packet capture is started and stopped via Wireshark commands. Remote capture can be enabled or disabled using the CLI. The network operator should obtain a computer with the Wireshark tool to display the captured traffic. When using remote capture mode, the switch doesn't store any captured data locally. The local TCP port number can be configured for connecting Wireshark to the switch. The default port number is 2002. If a firewall is installed between the Wireshark PC and the switch, these ports must be allowed to pass through the firewall. The Firewall must be configured to allow the Wireshark PC to initiate a TCP connection to the switch. Layer 2 Switching Commands 716