Filter
Top Products
69-21
User Guide for Cisco Security Manager 4.4
OL-28826-01
Chapter 69 Using External Monitoring, Troubleshooting, and Diagnostic Tools
Using the Packet Capture Wizard
• Read capture buffer every 10 seconds—Select this option to automatically retrieve captured data
every 10 seconds. You must use the circular buffer when selecting this option.
• Use a circular buffer—Select this option to continue capturing packets after the buffer is full. When
you choose this setting, if all the buffer storage is used, the capture starts overwriting the oldest
packets.
• Buffer Size—Enter the number of bytes (between 1534 and 33554432) that the capture can use to
store packets.
• Maximum Packet Size—Enter the number of bytes (between 14 and 1522) that the capture can use
to store a single packet. Use the largest value, 1522,to capture as much information as possible.
Step 11 Click Next to proceed to the Summary step, which shows the traffic selectors and buffer parameters that
you have entered.
Step 12 Click Next to proceed to the Run, View & Save step.
Step 13 From the Run, View & Save step, you can do the following:
• Click Start Capture to begin capturing packets.
• Click Stop Capture to stop capturing packets.
• To fetch the next set of captured packets, do one of the following:
–
For individual devices, click Display Capture Packets to fetch the next set of captured packets
from the device and update the buffer status bar. This button is only enabled if the Read capture
buffer every 10 seconds option was not selected during the Set buffer parameters step.
–
For clusters, click Get Cluster Capture Summary to fetch the next set of captured packets
from the devices in the cluster and update the buffer status bar. This button is only enabled if
the Read capture buffer every 10 seconds option was not selected during the Set buffer
parameters step.
• When running a capture for an ASA cluster, the following option are available for working with the
capture buffers of the devices in the cluster:
–
To view the captured packets from a device in the cluster, select the device in the Device Name
list under Get Capture Buffer, and then click Get Capture Buffer.
The capture information for the selected device is displayed. Refer to the other options in this
list for the actions you can perform on this data.
–
To remove the capture content for a specific device or all devices in the cluster and allow room
in the buffer to capture more packets, select the device or --All-- in the Device Name field under
Clear Capture Buffer, and then click Clear Capture Buffer.
Note We recommend saving captures prior to clearing the device buffers. If you do not save
captures prior to clearing the device buffers, captured data will be lost.
• Click the Launch Network Sniffer button above the Ingress Capture window or the Egress Capture
window to view the corresponding ingress or egress capture using an external packet analyzer tool.
You must have a packet analyzer installed and associated with *.pcap file extension.
• Click View Data in Larger Window to view the packet capture data side-by-side in a larger
window.
• Click Save captures to display the Save Capture dialog box. Choose the format in which you want
to include the captures: ASCII or PCAP. You have the option of saving either the ingress capture or
the egress capture.