What is Packet Capture? - SonicWALL

Configuring Packet Capture
Figure 11
Advanced Settings Window
Step 4
Step 5
Step 6
Step 7
Step 8
To capture packets generated by the SonicWALL appliance, select the Capture Firewall Generated
Packets checkbox.
Even when interfaces specified in the capture filters do not match, this option ensures that packets
generated by the SonicWALL appliance are captured. This includes packets generated by HTTP(S), L2TP,
DHCP servers, PPP, PPPOE, and routing protocols. Captured packets are marked with ‘s’ in the incoming
interface area when they are from the system stack. Otherwise, the incoming interface is not specified.
To capture intermediate packets generated by the SonicWALL appliance, select the Capture Intermediate
Packets checkbox.
Intermediate packets include packets generated as a result of fragmentation or reassembly, intermediate
encrypted packets, IP helper generated packets, and replicated multicast packets.
To exclude encrypted management or syslog traffic to or from GMS, select the Exclude encrypted GMS
traffic checkbox.
This setting only affects encrypted traffic within a configured primary or secondary GMS tunnel. GMS
management traffic is not excluded if it is sent via a separate tunnel.
To exclude management traffic, select the Exclude Management Traffic checkbox and select one or more
checkboxes for HTTP/HTTPS, SNMP, or SSH.
If management traffic is sent via a tunnel, the packets are not excluded.
To exclude syslog traffic to a server, select the Exclude Syslog Traffic to checkbox and select one or more
checkboxes for Syslog Servers or GMS Server.
If syslog traffic is sent via a tunnel, the packets are not excluded.
Restarting FTP Logging
If automatic FTP logging is off, either because of a failed connection or simply disabled, you can restart it
in Configure > Logging.
Step 1
Navigate to the Packet Capture page in the UI.
SonicOS Enhanced Packet Capture
17