What is Packet Capture? - SonicWALL
What is Packet Capture? - SonicWALL
What is Packet Capture? - SonicWALL
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Configuring <strong>Packet</strong> <strong>Capture</strong><br />
SonicOS Enhanced adds one of four possible packet status values to each captured packet: forwarded,<br />
generated, consumed, and dropped. You can select one or more of these status values to match when<br />
d<strong>is</strong>playing packets. The status value shows the state of the packet with respect to the firewall, as follows:<br />
– Forwarded - The packet arrived on one interface and the <strong>SonicWALL</strong> appliance sent it out on<br />
another interface.<br />
– Generated - The <strong>SonicWALL</strong> appliance created the packet during the process of encryption or<br />
decryption, fragmentation or reassembly, or as a result of certain protocols.<br />
– Consumed - The packet was destined for the <strong>SonicWALL</strong> appliance.<br />
– Dropped - The <strong>SonicWALL</strong> appliance did nothing further with the packet. The firewall might have<br />
identified the packet as malformed, malicious, on the deny l<strong>is</strong>t, or not on the allow l<strong>is</strong>t.<br />
Note<br />
If a field <strong>is</strong> left blank, no filtering <strong>is</strong> done on that field. <strong>Packet</strong>s are d<strong>is</strong>played without regard<br />
to the value contained in that field of their headers.<br />
Step 1<br />
Step 2<br />
Step 3<br />
Navigate to the <strong>Packet</strong> <strong>Capture</strong> page in the UI.<br />
See “Accessing <strong>Packet</strong> <strong>Capture</strong> in the UI” on page 5.<br />
Under <strong>Packet</strong> <strong>Capture</strong>, click Configure.<br />
In the <strong>Packet</strong> <strong>Capture</strong> Configuration window, click the D<strong>is</strong>play Filter tab.<br />
Figure 9<br />
Filter Settings Window<br />
Step 4<br />
Step 5<br />
Step 6<br />
In the Interface Name(s) box, type the <strong>SonicWALL</strong> appliance interfaces for which to d<strong>is</strong>play packets, or<br />
use the negative format (!X0) to d<strong>is</strong>play packets captured from all interfaces except those specified. To<br />
d<strong>is</strong>play packets captured on all interfaces, leave blank.<br />
In the Ether Type(s) box, enter the Ethernet types for which you want to d<strong>is</strong>play packets, or use the<br />
negative format (!ARP) to d<strong>is</strong>play packets of all Ethernet types except those specified. To d<strong>is</strong>play all<br />
Ethernet types, leave blank.<br />
In the IP Type(s) box, enter the IP packet types for which you want to d<strong>is</strong>play packets, or use the negative<br />
format (!UDP) to d<strong>is</strong>play packets of all IP types except those specified. To d<strong>is</strong>play all IP types, leave blank.<br />
14 SonicOS Enhanced <strong>Packet</strong> <strong>Capture</strong>
Change language