To configure a PCAP session for a mirror site
Steps
Mirrored packets can be captured in a PCAP file and viewed offline. A single capture provides all relevant protocol packets. Byte level details are also provided for each captured packet.
1 |
Create the mirror service. See To create a mirror service . |
2 |
On the mirror service, create a source site. See To create a source site on a mirror service . |
3 |
Select the source site and click Properties. The Mirror Service (Edit) form opens. |
4 |
Click on the PCAP Sessions tab and click Create. The PCAP Session (Create) form opens. |
5 |
Configure the Session Name, Capture Count, and File URL parameters. The NFM-P can capture up to 250 packets from a mirror source. You must provide a valid IP address for the generated PCAP file. If you want to use a new URL, you do not need to recreate the PCAP session. Delete the URL, apply any changes, and re-enter the new URL. |
6 |
Click Apply. The new PcapSessions appears under the Mirror Service - Source Sites in the navigation tree. |
7 |
On the MirrorPCAP session tab, click Start Pcap Session. The Session State parameter indicates the capture state of the PCAP session. If you want to stop the PCAP session, you can use the Stop pcap capture option. If you stopped and started a PCAP session without changing the file URL or PCAP file name, the previously captured information will be overwritten. |
8 |
View the details of the PCAP file from the URL you specified. Statistics for the PCAP session are available on the Statistics tab. Scheduled statistics are not supported. PCAP session statistics are valid only when the PCAP session is in progress. |
9 |
Save the changes and close the forms. End of steps |