Working with Packet Capture

The SBC performs Packet Capture using 'tcpdump' and allows the captured file to be downloaded. The following section describes how to capture packets and download them.

Enabling Packet Capture

The Enable Packet Capture option (available from the Packet Capture menu bar) enables the packet capture capability in the

To enable packet capture:

1. In the WebUI, click the Diagnostics tab.
   
   

2. In the left navigation bar, select 

   Unable to show "metadata-from": No such page "_space_variables"
    Service Troubleshooting > Packet Capture.

   For

   Unable to show "metadata-from": No such page "_space_variables"

   Unable to show "metadata-from": No such page "_space_variables"

   recommends that you insert either an ASM or external USB into the

   Unable to show "metadata-from": No such page "_space_variables"

   in order to save packet capture files; otherwise only a small capture session is permitted due to available space limitations on the internal flash.

3. From the menu bar, click Enable Packet Capture.

   Enable Packet Capture

   

4. At the Warning note, click OK. 

   Because packet capture can have an impact on SBC operation with network traffic, Ribbon recommends examining the debugging logs to determine whether the information in the logs is sufficient for troubleshooting and analyzing issues. If more information is required, enable Packet Capture only under the direction of

   Unable to show "metadata-from": No such page "_space_variables"

   Support.

Packet Capture is enabled. Refer to Start Packet Capture.

Starting Packet Capture

The Start Capture option (available from the Packet Capture menu bar) enables the

To start capturing packets:

1. In the WebUI, click the Diagnostics tab.
   
   

2. In the left navigation bar, select 

   Unable to show "metadata-from": No such page "_space_variables"
   Service Troubleshooting > Packet Capture.
   
   

3. From the menu bar, click Start Capture.

   Start Capture

   

   Packet Capture Options

   
4. Select the network interface (including IP Version) from which the packets will be captured.
   
   
5. Select protocol(s) from which to capture the packets.
   
   
6. Configure any relevant information for the Other Options sections. For details, refer to Field Definitions.
   
   

7. Click OK.
   
   The Packet Capture status turns to In Progress.

   Packet Capture in Progress

   

Interface - Field Definitions

Protocol - Field Definitions

Other Options - Field Definitions

Stopping Packet Capture

The Stop Packet capture feature is optional; this option stops the packet capture early (before the packet capture reaches the time limit set in the Duration field).

To stop capturing packets:

1. In the WebUI, click the Diagnostics tab.
   
   

2. In the left navigation bar, select

   Unable to show "metadata-from": No such page "_space_variables"
    Service Troubleshooting > Packet Capture.
   
   

3. From the menu bar, click Stop Capture.

   Stop Capture Option

   

   
   The Packet Capture stops.

   Packet Capture Stops

   

Restarting Packet Capture

The Restart Packet capture feature is optional; use this option to repeat or restart the last packet capture performed. 

To restart or repeat the last packet capture:

1. In the WebUI, click the Diagnostics tab.
2. In the left navigation bar, select 
   Unable to show "metadata-from": No such page "_space_variables"
    ServiceTroubleshooting > Packet Capture.

3. From the menu bar, click Restart Last Capture.

   Restart Last Capture Option

   

4. Click the appropriate field to change any packet capture options that need to change.

   Packet Capture Options

   

5. Click OK.
   
   The Packet Capture status turns to In Progress.

   Packet Capture in Progress

   

Downloading Capture Files

Once the packet capture has stopped, the captured file will appear in the table List of Captured Files.

To download captured files:

1. From the List of Capture Files table, next to the desired file, click Download.

   Capture Files

   

2. Select the appropriate location to save the file. Click OK.

   Save File

   

    

    

Deleting a Packet Capture File

The List of Packet Capture Files allows you to delete packet capture files from the 

To delete packet capture files:

1. From the List of Packet Capture Files, click the check box on the left of the filename of the packet capture file you want to delete to select it. To delete multiple files, click multiple check boxes. To delete all files, click the check box at the top of the column.
   
   

   List of Packet Capture Files

   

2. Click the X at the top of the column to delete the indicated file(s). 

Moving Internal or ASM Capture Files

If the file location for the packet capture is Internal or an ASM, and the system has an external USB present and available, an additional option, Move, will appear under the Action column. The Move action relocates the packet file to the external USB, which can then be removed and taken to a PC. 

To move captured files:

1. From the List of Capture Files table, next to the desired file, click Move.

   List of Capture Files

   

Packet Capture Limitations

The following lists the limitations of Packet Capture.

Size Limitations

1. An individual Packet Capture file is limited to 350 MiB in size. After the 350 MiB limit has been reached, a new file will be created to continue the packet capture.
   
   
2. A Packet Capture session size limit is dependent on whether or not
   
   1. 30 GiB is less than the available storage space minus ( - ) 30%
      Or
   2. Available storage space minus ( - ) 30% is less than 30 GiB
      
      
3. For SBC 1000, if there is no external USB or ASM module with a mounted hard drive, the Packet Capture will not be allowed to occur because of storage limitations.

Protocol Filters Restrictions

If Protocol Filters Active Directory, HTTP/HTTPS, or All Other Protocols are set to True, the following options will be hidden and no longer configurable:

1. Media
   
   

2. DSP/CSME
    

3. TCP/UDP Ports

TCP/UPD Ports Restrictions

If any TCP/UDP Ports are entered, the following options will be hidden and no longer configurable:

1. Active Directory
   
   
2. HTTP/HTTPS
   
   
3. All Other Protocols