Contents

Configuring packet capture· 1

About packet capture· 1

Restrictions and guidelines: Packet capture configuration· 1

Packet capture tasks at a glance· 1

Configuring packet capture settings· 1

Starting packet capture· 2

Stopping packet capture· 2

Display and maintenance commands for packet capture· 2

Configuring packet capture

About packet capture

The packet capture feature captures incoming and outgoing packets, generates packet capture records, and saves the records to a .cap file. The file can reside on the device or a remote file server. You can use a packet analyzer such as Wireshark to view the file for traffic analysis.

The minimum packet capture unit is a packet. The packet capture process is as follows:

1.     The device captures a specific number of bytes from a packet and generates a packet capture record, ignoring the remaining part of the packet (if any).

2.     The device saves the packet capture record in memory.

3.     When the maximum number of packet capture records for a file is reached, the device saves the records to a file and clears the records in memory.

Restrictions and guidelines: Packet capture configuration

Start packet capture only when necessary. Packet capture affects device performance.

Only one packet capture process can run on the device.

You can configure packet capture parameters only when packet capture is not started.

If packet capture saves .cap files on the device, back up the .cap files on the device as required after you finish packet capture. Starting packet capture again deletes the existing .cap files.

Packet capture is supported only for the default context and non-default contexts that use their own respective interfaces. It is not supported on shared interfaces of a non-default context. For more information about contexts, see context configuration in Virtual Technologies Configuration Guide.

Packet capture tasks at a glance

To configure packet capture, perform the following tasks:

1.     Configuring packet capture settings

2.     Starting packet capture

3.     Stopping packet capture

Configuring packet capture settings

1.     Enter system view.

system-view

2.     Set the maximum packet size for a packet capture record.

packet-capture max-bytes bytes

By default, the maximum packet size is 1600 bytes for a packet capture record.

To capture all bytes of packets, make sure the maximum packet size for a packet capture record is equal to or greater than the interface MTU.

3.     Set the maximum number of packet capture records for a file.

packet-capture max-file-packets number

By default, the maximum number of packet capture records is 100 for a file.

4.     Specify the storage directory for the .cap files.

packet-capture storage { local [ limit limit-space ] | remote serverpath [ vpn-instance vpn-instance-name ] [ user username [ password { cipher | simple } string ] ] }

The default storage directory is the pcap directory of the default file system on the master.

Starting packet capture

1.     Enter system view.

system-view

2.     Start packet capture.

packet-capture start [ acl { acl-number | ipv6 acl-number } | interface interface-type interface-number ] *

By default, the system does not capture packets.

Stopping packet capture

About this task

Saving packet capture records to a file takes time. The packet-capture stop command without the immediately keyword saves all packet capture records to a file before stopping packet capture. If you do not want to use the packet capture records in memory, execute the packet-capture stop immediately command.

Procedure

1.     Enter system view.

system-view

2.     Stop packet capture.

packet-capture stop [ immediately ]

Display and maintenance commands for packet capture

Execute display commands in any view.