Cisco Cisco Prime Infrastructure 3.0 Troubleshooting Guide

Here are two examples that illustrate the manner in which captured files are copied to a location that is outside
of the server:

In this example, the capture file is copied to an FTP server with an IP address of 1.2.3.4:

copy disk:/test−capture.pcap ftp://1.2.3.4/

• 

In this example, the capture file is copied to a TFTP server with an IP address 5.6.7.8:

copy disk:/test−capture.pcap tftp://5.6.7.8/

• 

If you desire more granular captures, log into the CLI as a root user after you have logged in as an admin user.

test$ ssh admin@12.13.14.15

Password: 

nms−pi/admin#

nms−pi/admin# root

Enter root password :

Starting root bash shell ...

ade # su −

[root@nms−pi~]#

Here are three examples of captures that are taken by a root user:

In this example, all of the packets that are destined to port 162 on the PI server are captured:

[root@nms−pi~]# tcpdump −i eth0 −s0 −n dst port 162

• 

In this example, all of the packets that are destined to port 9991 are captured and written to a file
called test.pcap in the /localdisk/ftp/ directory:

[root@nms−pi~]# tcpdump −w /localdisk/ftp/test.pcap −s0 −n dst port 9991

• 

In this example, any packets with a source IP address of 1.1.1.1 are captured:

[root@nms−pi~]# tcpdump −n src host 1.1.1.1

• 

Updated: Mar 16, 2015

Document ID: 118840