Cisco Switch Packet Capture

!Define filter
conf t
ip access-list extended PXEcap
permit ip host 10.10.9.1 any
permit ip host 10.10.9.11 any
permit ip host 10.63.56.2 any
permit ip any host 10.10.9.1
permit ip any host 10.10.9.11
permit ip any host 10.63.56.2
end
!

!Define buffer
monitor capture buffer PXEbuf size 2048 max-size 1518 linear
!

!Bind filter to buffer
monitor capture buffer PXEbuf filter access-list PXEcap
!

!Define capture point
monitor capture point ip cef PXEpoint gi0/1 both
\#monitor capture point ip process-switched PXEpoint gi0/1 both
!

!Bind buffer to capture point
monitor capture point associate PXEpoint PXEbuf
!

!Start
monitor capture point start PXEpoint
!

!Stop
monitor capture point stop PXEpoint
!

!View
show monitor capture buffer PXEbuf
!

!Export
monitor capture buffer PXEbuf export tftp://10.10.10.13/PXEcapture.pcap
!

!Cleanup capture
no monitor capture point ip cef PXEpoint gi0/1 both
no monitor capture buffer PXEbuf

!Cleanup filter
conf t
no ip access-list extended PXEcap
end
!

!Useful
show monitor capture buffer all parameter
!