packet-capture

This command manages a packet-capture for the Ethernet interface session.

Syntax

Start a packet-capture session: packet-capture file seconds KB ["expression"]
Stop a packet-capture session: no packet-capture file

Parameters

file: Specifies the file name for the packet capture. You can simultaneously capture packets on multiple interfaces by specifying a different file name for each interface.
seconds: Specifies the maximum duration of the packet-capture session in seconds. Enter a value in the range 5 - 86400. The special value of -1 indicates that the packet capture is continuous and completes when it reaches the maximum file size or until you issue the no packet-capture command.
KB: Specifies the maximum size of the file in KB. Enter a value in the range 10 - 500000.
expression: Optionally specifies the expression that filters the packet capture. Enclose the expression in double quotation marks.

Guidelines

The packet-capture command manages a packet-capture session on the current interface. The data from the session is saved in the pcap format. To interpret the packet, use a network protocol analyzer.

Use the no packet-capture command to stop a packet-capture session.

Examples

Start a timed packet-capture session that writes data to the temporary:///capture-1 file. The session completes either after 30 minutes or when the file contains 2500 KB, whichever occurs first.
```
# packet-capture temporary:///capture-1 1800 2500
Trace begun.
#
```
Start a timed packet-capture session that writes data to the temporary:///capture-2 file. The session records only packets where 53 is the destination port. The session completes either after 30 minutes or when the file contains 2500 KB, whichever occurs first.
```
# packet-capture temporary:///capture-2 1800 2500 "dst port 53"
Trace begun.
#
```
Start a continuous packet-capture session that writes data to the temporary:///capture-3 file. The session completes either when it contains 50000 KB or when you stop it.
```
# packet-capture temporary:///capture-3 -1 50000
Trace begun.
#
```

Stop the packet-capture session that writes data to the temporary:///capture-3 file.

# packet-capture temporary:///capture-3
Continuous packet capture to temporary:///capture-3 on interface stopped.
#