13-2
Cisco Intrusion Prevention System Sensor CLI Configuration Guide for IPS 7.2
OL-29168-01
Chapter13 Displaying and Capturing Live Traffic on an Interface
Understanding Packet Display and Capture
Understanding Packet Display and Capture
You can display or capture live traffic from an interface and have the live traffic or a previously captured
file put directly on the screen. Storage is available for one local file only, subsequent capture requests
overwrites an existing file. The size of the storage file varies depending on the platform. A message may
be displayed if the maximum file size is reached before the requested packet count is captured.
Displaying Live Traffic on an Interface
Use the packet display interface_name [snaplen length] [count count] [verbose] [expression
expression] command to display live traffic from an interface directly on your screen. Use the packet
display iplog id [verbose] [expression expression] to display IP logs.
Note
To terminate the live display, press Ctrl-C.
The following options apply:
•
interface_name—Specifies the interface name, interface type (GigabitEthernet, FastEthernet,
Management, PortChannel) followed by slot/port. You can only use an interface name that exists in
the system.
•
snaplen—(Optional) Specifies the maximum number of bytes captured for each packet. The valid
range is 68 to 1600. The default is 0. A value of 0 means use the required length to catch whole
packets.
•
count—(Optional) Specifies the maximum number of packets to capture. The valid range is 1 to
10000.
Note
If you do not specify this option, the capture terminates after the maximum file size is
captured.
•
verbose—(Optional) Displays the protocol tree for each packet rather than a one-line summary.
•
expression—Specifies the packet-display filter expression. This expression is passed directly to
TCPDUMP and must meet the TCPDUMP expression syntax.
Note
The expression syntax is described in the TCPDUMP man page.
Note
If you use the expression option when monitoring packets with VLAN headers, the
expression does not match properly unless vlan and is added to the beginning of the
expression. For example, packet display iplog 926299444 verbose expression icmp Will
NOT show ICMP packets; packet display iplog 926299444 verbose expression vlan and
icmp WILL show ICMP packets. It is often necessary to use expression vlan and on the IPS
appliance interfaces connected to trunk ports.
•
file-info—Displays information about the stored packet file. File-info displays the following
information:
Captured by: user:id, Cmd: cliCmd