monitor capture $name interface $interface both buffer size 100 match ipv4 protocol udp host $srcip any eq 53 bidirectional start: capture 100MB of DNS traffic from srcip to any server both direction
show monitor capture: view current capture
monitor capture $name stop_export: stop and export result