IronPort - daily management guide - AsyncOS 7.6.1

Chapter 8 Common Administrative Tasks
Starting a Packet Capture
OL-25138-01
Cisco IronPort AsyncOS 7.6 for Email Daily Management Guide
Support Commands
The Support and Help > Packet Capture page in the GUI displays the list of complete packet capture files
stored on the hard drive. When a packet capture is running, the Packet Capture page shows the status of
the capture in progress by showing the current statistics, such as file size and time elapsed.
You can download a packet capture file using the Download File button and forward it in an email to
Cisco IronPort Customer Support for debugging and troubleshooting purposes. You can also delete a
packet capture file by selecting one or more files and clicking Delete Selected Files.
In the CLI, use the packetcapture command.
Figure 8-6 shows the Packet Capture page in the GUI.
Figure 8-6 Packet Capture Page
Note The packet capture feature is similar to the Unix tcpdump command.
To start a packet capture in the CLI, run the packetcapture > start command. If you need to stop a
running packet capture, run the packetcapture > stop command. The appliance stops the packet capture
when the session ends.
To start a packet capture in the GUI, select the Packet Capture option under the Support and Help menu,
and then click Start Capture. To stop a running capture, click Stop Capture. A running capture started
in the GUI is preserved between sessions.
Note The GUI only displays packet captures started in the GUI, not from the CLI. Similarly, the CLI only
displays the status of a current packet capture run started in the CLI. Only one capture may be running
at a time.
Editing Packet Capture Settings
To edit the packet capture settings in the CLI, run the packetcapture > setup command.
To edit packet capture settings in the GUI, select the Packet Capture option under the Support and Help
menu, and then click Edit Settings.
8-9