Cisco Catalyst 4500 Series Configuration Manual page 945

Chapter 2
show monitor capture file
To decode and display packets from a previously captured .pcap file, use the show monitor capture file
command.
Syntax Description name
display-filter filter-string
brief | detailed | dump
Command Default brief
Command Modes Privileged EXEC mode
Command History Release
IOS XE 3.3.0SG/
15.1(1)SG
Usage Guidelines If no display filter is specified, then all the packets in the file are displayed. Because the display filter
must observe the Wireshark display filter syntax, ensure that the display filter is accurate. Also, use a
double quotes when specifying the filter.
Examples
The following example shows how to display packets from a .pcap file with a display filter:
Switch# show monitor capture file bootflash:test.pcap display-filter
This example displays a brief output from a .pcap file:
Switch# show monitor capture file bootflash:mycap.pcap
1
20002
2
20002
3
20002
show monitor capture file name [display-filter filter-string] [brief | detailed | dump]
Specfies the filename.
Specifies the display filter string according to Wireshark's display-filter
syntax.
Determines the display mode.
Modification
This command was introduced on the Catalyst 4500 series switch.
0.000000 10.1.1.140 -> 20.1.1.2
1.000000 10.1.1.141 -> 20.1.1.2
2.000000 10.1.1.142 -> 20.1.1.2
Catalyst 4500 Series Switch Cisco IOS Command Reference—Release XE 3.9.xE and 15.2(5)Ex
brief—Displays a one line summary of the packet with key fields
detailed—Displays all the fields in the packet for the protocols
supported and displays the payload in hexadecimal form.
dump—Displays a one line summary of the packet with key fields
and also displays the packet in hexadecimal form.
UDP Source port: 20001
UDP Source port: 20001
UDP Source port: 20001
show monitor capture file
Destination port:
Destination port:
Destination port:
2-897