Packet capture configuration commands 1

display packet capture buffer 1

display packet capture status 2

packet capture· 3

packet capture buffer save· 4

packet capture schedule· 5

packet capture start 6

packet capture stop· 7

reset packet capture buffer 8

 

display packet capture buffer

Syntax

display packet capture buffer [ start-index [ end-index ] ] [ length display-length ]

View

Any view

Default level

1: Monitor level

Parameters

start-index: Specifies a start packet record by its index in the packet capture buffer. If you do not specify this argument, the earliest packet record is displayed the first in the packet capture buffer by default.

end-index: Specifies an end packet record by its index in the packet capture buffer. If you do not specify this argument, the latest packet record is displayed the last in the packet capture buffer by default.

length display-length: Specifies the maximum length of data that can be displayed for a single packet record, in the range of 14 to 256 bytes. The default value is 68.

Description

Use display packet capture buffer to display the contents in the packet capture buffer.

·     If you do not specify any option, the command displays all packet records in the packet capture buffer.

·     This command limits the length of data that can be displayed for a single packet record. To display complete packet records, use the packet capture buffer save command to save the contents in a .pcap file, and display the contents by using the corresponding software.

·     Do not use this command during the packet capturing process.

Related commands: packet capture start and packet capture buffer save.

Examples

# Display all contents in the packet capture buffer.

<Sysname> display packet capture buffer

2012-07-26 12:03:15:318  Index 1  GE4/0/2  64 (original 64) Bytes captured

  01 80 c2 00 00 03 1c bd b9 e3 b5 02 81 00 00 01

  88 8e 01 01 00 00 00 00 00 00 00 00 00 00 00 00

  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

2012-07-26 12:03:25:749  Index 2  GE4/0/2  68 (original 90) Bytes captured

  33 33 00 00 00 12 00 00 5E 00 02 50 86 DD 6E 00

  00 00 00 20 70 FF FE 80 00 00 00 00 00 00 00 00

  00 00 00 00 00 81 FF 02 00 00 00 00 00 00 00 00

  00 00 00 00 00 12 31 50 64 01 02 58 6A AE FE 80

  00 00 00 00

display packet capture status

Syntax

display packet capture status

View

Any view

Default level

1: Monitor level

Parameters

None

Description

Use display packet capture status to display the current packet capture status.

Examples

# Display the current packet capture status.

<Sysname> display packet capture status

  Current status :          In process

  Mode :                    Linear

  Buffer size :             2097152 (bytes)

  Buffer used :             0 (bytes)

  Max capture length :      68 (bytes)

  ACL information :         Ethernet frame header ACL 4200

  Schedule datetime:        Unspecified

  Upper limit of duration : Unspecified (seconds)

  Duration :                60 (seconds)

  Upper limit of packets :  Unspecified

  Packets count :           0

Table 1 Command output

Field	Description
Current status	Packet capture status: ·     In process—The packet capturing process is ongoing. ·     Scheduled—The packet capture schedule is configured, but does not start. ·     Paused—Packet capture is stopped temporarily, and you can display, save, and clear the contents in the packet capture buffer.
Mode	Packet capture mode: ·     Linear. ·     Circular.
Buffer size	Packet capture buffer size.
Buffer used	Packet capture buffer size in use. One packet record comprises a packet header that records the incoming port, capture time, length of the captured packet and the actual length of the packet, and the data, so it occupies more buffer memory than the maximum captured data.
Max capture length	Maximum length of data that can be captured for a packet.
ACL information	ACL type and number for packet capture.
Schedule datetime	Start time of the packet capture schedule.
Upper limit of duration	Upper limit of the packet capture duration.
Duration	Packet capture duration.
Upper limit of packets	Maximum number of packets that can be captured.
Packets count	Number of packets that has been captured.

 

packet capture

Syntax

packet capture { acl { acl-number | ipv6 acl6-number } | buffer-size size | length capture-length | mode { circular | linear } }*

undo packet capture [ acl |buffer-size | length | mode ]

View

User view

Default level

1: Monitor level

Parameters

acl: Specifies an ACL for packet capture. If you do not specify this keyword, this command captures all packets that the device receives.

acl-number: Specifies the number of an IPv4 ACL:

·     2000 to 2999 for IPv4 basic ACLs

·     3000 to 3999 for IPv4 advanced ACLs

·     4000 to 4999 for Ethernet frame header ACLs

acl6-number: Specifies the number of an IPv6 ACL:

·     2000 to 2999 for IPv6 basic ACLs

·     3000 to 3999 for IPv6 advanced ACLs

buffer-size size: Specifies the packet capture buffer size in the range of 32 to 65535 KB. The default value is 2048.

length capture-length: Specifies the maximum length of the data that can be captured for a packet, calculated from the first byte of the packet, in the range of 16 to 4000 bytes. The default value is 68. The data out of the range of the maximum length is not recorded.

circular: Specifies the circular packet capture mode. In this mode, packet capture continues even if the buffer is full, and the newly captured packet overwrites the previous records, starting from the earliest one.

linear: Specifies the linear packet capture mode. In this mode, packet capture pauses when the buffer is full. The default mode is linear mode.

Description

Use packet capture to set packet capture parameters.

Use undo packet capture to restore the default settings, and disable the packet capture function.

·     Do not change packet capture parameters during the packet capturing process.

·     If you specify a keyword for the undo packet capture command, the command restores the default setting for the specified keyword. If you do not specify any keyword, the command restores the default settings for all keywords, and disables the packet capture function.

·     To capture IPv6 packets based on IPv6 ACLs, execute the acl ipv6 enable command first. For more information about the acl ipv6 enable command, see ACL and QoS Command Reference.

Related commands: packet capture start.

Examples

# Set the size of the packet capture buffer to 4096 KB, the source address of packets to be captured to 192.168.1.0/24, and start packet capture immediately.

<Sysname> system-view

[Sysname] acl number 2000

[Sysname-acl-basic-2000] rule permit source 192.168.1.0 0.0.0.255

[Sysname-acl-basic-2000] quit

[Sysname] quit

<Sysname> packet capture buffer-size 4096

<Sysname> packet capture acl 2000

<Sysname> packet capture start

# Restore the default settings for packet capture parameters, and disable packet capture.

<Sysname> undo packet capture

packet capture buffer save

Syntax

packet capture buffer save [ filename ]

View

User view

Default level

1: Monitor level

Parameters

filename: Specifies the name of the file to be saved. The filename cannot contain special characters such as backslash (\), slash (/), colon (:), asterisk (*), quotation marks (" "), less-than sign (<), greater-than sign (>), and vertical bar (|). If you do not specify this argument, the command saves the file in the default filename pcapbuffer.pcap.

Description

Use packet capture buffer save to save the contents in the packet capture buffer.

·     Save the file with a filename in the .pcap format.

·     Do not use this command during the packet capturing process.

Related commands: packet capture.

Examples

# Save the contents in the packet capture buffer to file example.pcap.

<Sysname> packet capture buffer save example.pcap

packet capture schedule

Syntax

packet capture schedule datetime time date

undo packet capture schedule

View

User view

Default level

1: Monitor level

Parameters

time: Sets the time in the format of HH:MM:SS. HH takes a value range of 0 to 23, and MM and SS take a value range of 0 to 59.

date: Sets the date in the format of MM/DD/YYYY or YYYY/MM/DD. MM takes a value range of 1 to 12, YYYY takes a value range of 2000 to 2035, and the value range of DD depends on which month the day is in.

Description

Use packet capture schedule to configure a packet capture schedule.

Use undo packet capture schedule to invalidate the configured packet capture schedule.

By default, no packet capture schedule is configured.

·     You can use the packet capture start command to enable packet capture as in this command.

·     You can use the packet capture command to change packet capture parameters before the packet capture schedule starts, or use the packet capture start command to start packet capture immediately, and the existing packet capture schedule is invalidated.

·     To disable packet capture and invalidate the configured packet capture schedule, execute the undo packet capture start command or the undo packet capture command without any keyword.

Related commands: packet capture.

Examples

# Configure a packet capture schedule.

<Sysname> packet capture schedule datetime 12:00:00 2012/12/25

packet capture start

Syntax

packet capture start [ acl { acl-number | ipv6 acl6-number } | buffer-size size | length capture-length | mode { circular | linear } | [ packets packet-number | seconds second-number ] ]*

undo packet capture start

View

User view

Default level

1: Monitor level

Parameters

acl: Specifies an ACL for packet capture. If you do not specify this keyword, this command captures all packets that the device receives.

acl-number: Specifies the number of an IPv4 ACL:

·     2000 to 2999 for IPv4 basic ACLs

·     3000 to 3999 for IPv4 advanced ACLs

·     4000 to 4999 for Ethernet frame header ACLs

acl6-number: Specifies the number of an IPv6 ACL:

·     2000 to 2999 for IPv6 basic ACLs

·     3000 to 3999 for IPv6 advanced ACLs

buffer-size size: Specifies the packet capture buffer size in the range of 32 to 65535 KB. The default value is 2048.

length capture-length: Specifies the maximum length of the data that can be captured for a packet, calculated from the first byte of the packet, in the range of 16 to 4000 bytes. The default value is 68. The data out of the range of the maximum length is not recorded.

circular: Specifies the circular packet capture mode. In this mode, packet capture continues even if the buffer is full, and the newly captured packet overwrites the previous records, starting from the earliest one.

linear: Specifies the linear packet capture mode. In this mode, packet capture pauses when the buffer is full. The default mode is linear mode.

packets packet-number: Sets the upper limit of packets that can be captured, in the range of 1 to 4294967295. The default value is 4294967295. Packet capture pauses when the number of captured packets reaches the upper limit.

seconds second-number: Sets the upper limit for packet capture duration, in the range of 1 to 4294967295 seconds. The default value is 4294967295 seconds. Packet capture pauses when the packet capture duration reaches the upper limit.

Description

Use packet capture start to start packet capture, and set packet capture parameters at the same time.

Use undo packet capture start to disable packet capture.

By default, packet capture is disabled.

·     Do not start packet capture again or change parameters, or use the display packet capture buffer, reset packet capture buffer and packet capture buffer save commands during the packet capturing process. To do so, use the packet capture stop command to temporarily stop packet capture.

·     If packet capture is enabled and an ACL number is specified, but the specified ACL does not exist, no packet is captured. If you modify the ACL rule for the specified ACL, the result of packet capture is not affected. The modified ACL rule takes effect after the packet capture start command is successfully executed.

·     The undo packet capture start command stops packet capture, but the packet capture parameters configured are still effective, and you do no need to reconfigure them when you start packet capture again.

·     To capture IPv6 packets based on IPv6 ACLs, execute the acl ipv6 enable command first. For more information about the acl ipv6 enable command, see ACL and QoS Command Reference.

Related commands: packet capture stop, display packet capture status, and display packet capture buffer.

Examples

# Set the maximum length of the packet captured as 256 bytes, and start packet capture.

<Sysname> packet capture length 256 start

packet capture stop

Syntax

packet capture stop

View

User view

Default level

1: Monitor level

Parameters

None

Description

Use packet capture stop to temporarily stop packet capture.

·     After packet capture is stopped, if you use the packet capture command to change packet capture parameters, the contents in the capture buffer are cleared.

·     This command does not take effect if packet capture is not started.

·     After packet capture is stopped, you can use the display packet capture buffer, reset packet capture buffer, or packet capture buffer save command to display or perform operations on the contents in the packet capture buffer, and use the packet capture start command to start packet capture again.

Related commands: packet capture, packet capture start, display packet capture buffer, reset packet capture buffer, and packet capture buffer save.

Examples

# Stop packet capture.

<Sysname> packet capture stop

reset packet capture buffer

Syntax

reset packet capture buffer

View

User view

Default level

1: Monitor level

Parameters

None

Description

Use reset packet capture buffer to clear the contents in the packet capture buffer.

Do not use this command during the packet capturing process.

Related commands: packet capture start.

Examples

# Clear the contents in the packet capture buffer.

<Sysname> reset packet capture buffer