Blue Coat Systems Blue Coat Systems SG Appliance manual a.Capture all matching packets

Chapter 4: Diagnostics

6.Set the buffer size and method by choosing one of the following radio buttons:

a.Capture all matching packets.

b.Capture first n matching packets. Enter the number of matching packets (n) to capture. If the number of packets reaches this limit, packet capturing stops automatically. The value must be between 1 and 1000000.

c.Capture last n matching packets. Enter the number of matching packets (n) to capture. Any packet received after the memory limit is reached results in the discarding of the oldest saved packet prior to saving the new packet. The saved packets in memory are written to disk when the capture is stopped. The value must be between 1 and 1000000.

d.Capture first n matching Kilobytes. Enter the number of kilobytes (n) to capture. If the buffer reaches this limit, packet capturing stops automatically. The value must be between 1 and 102400.

e.Capture last n matching Kilobytes. Enter the number of kilobytes (n) to capture. Any packet received after the memory limit is reached results in the discarding of the oldest saved packet prior to saving the new packet. The saved packets in memory are written to disk when the capture is stopped. The value must be between 1 and 102400.

7.Optional—To truncate the number of bytes saved in each frame, enter a number in the Save first n bytes of each packet field. When configured, pcap collects, at most, n bytes of packets from each frame when writing to disk. The range is 1 to 65535.

8.Optional—To specify the number of kilobytes of packets kept in a core image, enter a value in the Include n K Bytes in core image field. You can capture packets and include them along with a core image. This is extremely useful if a certain pattern of packets causes the unit to restart unexpectedly. The core image size must be between 0 and 102400. By default, no packets are kept in the core image.

9.To start the capture, click the Start Capture button. The Start Capture dialog closes. Note that the Start captures button in the Packet Captures tab is now grayed out because packet capturing is already started.

You do not have to click Apply because all changes are applied when you start the packet capture.

10

11

10.To stop the capture, click the Stop capture button. This button is grayed out if a packet capture is already stopped.

11.To download the capture, click the Download capture button. This button is grayed out if no file is available for downloading.

55