What is Packet Capture? - SonicWALL

More documents

Recommendations

Info

Configuring Packet Capture Configuring Packet Capture You can access the packet capture tool on the System > Packet Capture page of the SonicOS UI. There are five main areas of configuration for the packet capture tool. The following sections describe the configuration options, and provide procedures for accessing and configuring packet capture: Configuring General Settings • “Configuring General Settings” section on page 10 • “Configuring Capture Filter Settings” section on page 11 • “Configuring Display Filter Settings” section on page 13 • “Configuring Logging Settings” section on page 15 • “Configuring Advanced Settings” section on page 16 • “Restarting FTP Logging” section on page 17 This section describes how to configure packet capture general settings, including the number of bytes to capture per packet and the buffer wrap option. You can specify the number of bytes using either decimal or hexadecimal, with a minimum value of 14. The buffer wrap option enables the packet capture to continue even when the buffer becomes full, by overwriting the buffer from the beginning. Step 1 Step 2 Step 3 Navigate to the Packet Capture page in the UI. See “Accessing Packet Capture in the UI” on page 5. Under Packet Capture, click Configure. In the Packet Capture Configuration window, click the General tab. Figure 7 General Settings Window Step 4 Step 5 In the Number of Bytes To Capture (per packet) box, type a number. The minimum value is 14. To continue capturing packets after the buffer fills up, select the Wrap Capture Buffer Once Full checkbox. 10 SonicOS Enhanced Packet Capture
Configuring Packet Capture Step 6 Selecting this option will cause packet capture to start writing captured packets at the beginning of the buffer again after the buffer fills. Click OK. Configuring Capture Filter Settings This section describes how to configure packet capture capture filter settings, including the following: • Interface on your SonicWALL appliance You can specify up to ten interfaces separated by commas. Refer to the Network > Interfaces screen in the UI for the available interface names. For example, for a SonicWALL PRO Series, you could specify: X0, X1, X2, X3. You can also use a negative value to configure all interfaces except the one(s) specified; for example: !X0, !X1. For the TZ 190, you could specify WAN, LAN, WWAN, OPT, or !WWAN, !OPT. • Ethernet type of the packets that you want to capture You can specify up to ten Ethernet types separated by commas. Currently, the following Ethernet types are supported: ARP, IP, PPPoE-SES, and PPPoE-DIS. The latter two can be specified by PPPoE alone. This option is not case-sensitive. For example, to capture all supported types, you could enter: ARP, ip, PPPOE. You can use one or more negative values to capture all Ethernet types except those specified; for example: !ARP, !PPPoE. You can also use hexadecimal values to represent the Ethernet types, or mix hex values with the standard representations; for example: ARP, 0x800, IP. Normally you would only use hex values for Ethernet types that are not supported by acronym in SonicOS Enhanced. See “Supported Packet Types” on page 21. • IP type of the packets that you want to capture You can specify up to ten IP types separated by commas. The following IP types are supported: TCP, UDP, ICMP, GRE, IGMP, AH, ESP. This option is not case-sensitive. You can use one or more negative values to capture all IP types except those specified; for example: !TCP, !UDP. You can also use hexadecimal values to represent the IP types, or mix hex values with the standard representations; for example: TCP, 0x1, 0x6. See “Supported Packet Types” on page 21. • Source IP addresses(es) from which to capture packets You can specify up to ten IP addresses separated by commas; for example: 10.1.1.1, 192.2.2.2. You can use one or more negative values to capture packets from all but the specified addresses; for example: !10.3.3.3, !10.4.4.4. • Source port(s) from which to capture packets You can specify up to ten port numbers separated by commas; for example: 20, 21, 22, 25. You can use one or more negative values to capture packets from all but the specified ports; for example: !80, !8080. • Destination IP address(es) for which to capture packets You can specify up to ten IP addresses separated by commas; for example: 10.1.1.1, 192.2.2.2. You can use one or more negative values to capture packets destined for all but the specified addresses; for example: !10.3.3.3, !10.4.4.4. • Destination port(s) for which to capture packets You can specify up to ten port numbers separated by commas; for example: 20, 21, 22, 25. You can use one or more negative values to capture packets destined for all but the specified ports; for example: !80, !8080. • Bidirectional address and port mapping When this option is selected, IP addresses and ports specified here will be matched against both the source and destination fields in each packet. SonicOS Enhanced Packet Capture 11
Page 1 and 2: Configuring the Packet Capture Feat
Page 3 and 4: Feature Overview How Does Packet Ca
Page 5 and 6: Using Packet Capture Using Packet C
Page 7 and 8: Using Packet Capture Table 1 Abbrev
Page 9: Using Packet Capture About the Hex
Page 13 and 14: Configuring Packet Capture Step 11
Page 15 and 16: Configuring Packet Capture Step 7 S
Page 17 and 18: Configuring Packet Capture Figure 1
Page 19 and 20: Verifying Packet Capture Activity V
Page 21 and 22: Related Information Related Informa
Page 23 and 24: Related Information Text File Forma

What is Packet Capture? - SonicWALL

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?