Cisco Switch with IOS XE capture commands

Cisco运行IOS XE的交换机支持抓包功能可以直接在交换机上使用monitor capture命令抓包并且可以定义ACL来精确匹配想要抓的流量。1.命令格式(全局模式非config模式)Monitor capture 名字 access-list ACL名字 interface 接口示例monitor capture capture access-list natcapture interface GigabitEthernet1/0/36 both buffer size102. Config step2.1 Define acl to match specify trafficipaccess-list extended natcapture permitiphost1.1.1.1host2.2.2.22.2 Config capture抓包10Mmonitor capture capture access-list natcapture interface GigabitEthernet1/0/36 both buffer size102.3 Start capturemonitor capture capture start2.4 Stop capturemonitor capture capture stop2.5 Check capture statusCATALYST9300# show monitor capture captureStatus InformationforCapture capture Target Type: Interface: GigabitEthernet1/0/36, Direction: BOTH Status:Inactive Filter Details: Core Filter not attached Buffer Details: Buffer Type: LINEAR(default)Buffer Size(in MB):10Limit Details: Number of Packets to capture:0(no limit)Packet Capture duration:0(no limit)Packet Size to capture:0(no limit)Maximum number of packets to capture per second:1000Packet sampling rate:0(no sampling)2.6 Export capture file to flash:CATALYST9300#monitor capture capture export flash:capture.pcapExported Successfully CATALYST9300#dir | in capture89076-rw-24Sep3202114:03:55 08:00 capture.pcap2.7 Delete capture configno monitor capture capture