Is there a correct syntax for CAPTURE?

[lchance]

I'm trying to build a packet capture on all UDP on the INSIDE interface but I want to omit any UDP on port 4163.

Is this even possible with the capture statements AND - does anyone know of a PDF which documents the full set and use of this CAPTURE command?

An example of what I've been trying, which I have yet to make it workout correctly.

capture Any-UDP-INSIDE-no-port4163 buffer 10000000 interface inside circular-buffer match udp any any neq 4163 match udp any any

[jensjacobsen]

You Can use a acl in The capture,

"

Access-list udplan deny any any eq 1463

Access-list udplan permit udp any any

cap xxx access-list udplan interface inside

"

/Jens

Sent from Cisco Technical Support iPad App

[lchance]

Thanks Jens...interesting method which I will use.

But I am still curious as to why CAPTURE has so many parameters and how these are to be used. I did find some usage information online with the COMMAND LOOKUP TOOL however it does not exactly match what is offered in the ASA IOS.

So I'm wondering if there's a PDF source online which explains everything about CAPTURE and its many parameters.