monitor capture file
To configure monitor capture (WireShark) storage file attributes, use the monitor capture file command in
privileged EXEC mode. To remove a storage file attribute, use the no form of this command.
monitor capture {capture-name} file{[ buffer-size temp-buffer-size ][ location file-location : file-name ][
ring number-of-ring-files ][ size total-size ]}
no monitor capture {capture-name} file{[ buffer-size ][ location ][ ring ][ size ]}
Syntax Description
The name of the capture to be modified.
capture-name
(Optional) Specifies the size of the temporary buffer. The range for
temp-buffer-size is 1 to 100 MB. This is specified to reduce packet loss.
buffer-size temp-buffer-size
(Optional) Specifies the location and file name of the capture storage
file. Acceptable values for file-location :
• flash—On-board flash storage
• (usbflash0:)— USB drive
location file-location : file-name
(Optional) Specifies that the capture is to be stored in a circular file chain
and the number of files in the file ring.
ring number-of-ring-files
(Optional) Specifies the total size of the capture files.
size total-size
Command Default
None
Command Modes
Privileged EXEC
Command History
ModificationRelease
This command was introduced.Cisco IOS XE 3.3SE
Usage Guidelines
Use the monitor capture file command only when the storage destination is a file. The file may be stored
either remotely or locally. Use this command after the packet capture has stopped. The packet capture is
stopped when one or more end conditions have been met or you entered the monitor capture stop command.
When WireShark is used on switches in a stack, packet captures can be stored only on the devices specified
for file-location above that are connected to the active switch. Example: flash1 is connected to the active
switch. flash2 is connected to the secondary switch. Only flash1 can be used to store packet captures.
Command Reference, Cisco IOS XE Everest 16.5.1a (Catalyst 3650 Switches)
497
monitor capture file