4500TEST#monitor capture MYCAP interface g2/26 both 4500TEST#monitor capture file bootflash:MYCAP.pcap 4500TEST#monitor capture MYCAP match any start *Sep 13 15:24:32.012: %BUFCAP-6-ENABLE: Capture Point MYCAP enabled.ģ) This will capture all traffic ingress and egress on port g2/26. The config is done from User EXEC mode, not global config mode. We will store the capture file on bootflash in a pcap file format for review from a local PC if necessary. 0 5 0 5 0 5 0 5 0 5 CPU% per second (last 60 seconds)Ģ) In this example I am capturing traffic in a TX/RX direction from port gig2/26. 4500TEST#show version Cisco IOS Software, IOS-XE Software, Catalyst 4500 元 Switch Software (cat4500e-UNIVERSAL-M), Version 03.03.00.SG RELEASE SOFTWARE (fc3) License Information for ' WS-X45-SUP7-E' License Level: entservices Type: Permanent Next reboot license Level: entservices cisco WS-C4507R+E (MPC8572) processor (revision 8) with 2097152K/20480K bytes of memory. Verify and Captureġ) Verify you meet the conditions to support the capture. This is very general and you will need implement filters and buffer setting as needed to limit the excessive capture of packets if troubleshooting in a production network. The following is a quick start guide to get a capture started.

Switch CPU is not in a high utilization condition as the Wireshark feature is CPU intensive and will software switch certain packets during capture.

Feature set IP Base and Enterprise Services (LAN Base is unsupported).

Supervisor 7 (supervisor 6 is unsupported at this time).

To utilize the Wireshark feature you must meet the following conditions.

This built in wireshark has the ability to capture packets in the way we would traditionally use SPAN with an attached PC for capturing packets in a troubleshooting scenario.

The 4500 series catalyst switches with the Supervisor 7 has a new built in functionality with IOS-XE version 3.3(0) / 151.1 or higher.

Cisco packet capture tool