4-16
User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0
OL-22617-01
Chapter 4 Capturing and Decoding Packet Data
Files
• Name:
• Size:
• Date:
• State:
• Location:
If you are using a Cisco 2200 Series appliance, the NAM will create a xxx.pcap file. If you click on the
download button, a xxx.pcap file will be created regardless of whether you accept the download action
or cancel it (a xxx.pcap file will be created once the download button is clicked). This is why one capture
using an appliance could have an extra file compared with a capture from another NAM platform.
Tab l e 4-6 Buttons in the Capture Files Operations Window
Operation Description
Decode Display the packets in a file.
Download Download a file to your computer in .enc or .pcap file format.
Note Do not add a file suffix when you provide the filename. The suffix
.pcap is added automatically.
Note .capture to .pcap conversion will occur when you download a
capture file. You will need to manually delete the .pcap file when
it is done.
Rename Give the file a new name. A dialog box displays and asks you to enter the
new name for the selected capture file.
Merge or
Convert/Merge
Merge packets of files.(in chronological order). A dialog box displays and
asks you to enter the new name for the merged capture files. Enter a name
for the merged capture files and choose OK.
Note Merged files cannot exceed 2 GB.
On the Cisco NAM 2200 Series appliances, this button is called
“Convert/Merge.” This can be used to convert one .capture file to a .pcap
file, so the Error Scan and the Analyze functions can be performed on that
converted file. Otherwise, Analyze and Error Scan cannot be performed on
a .capture file which only shows up on appliances.
Delete Delete files.
Analyze View statistical analysis of the selected capture. See Analyzing Capture
Files, page 4-17.
Errors Scan View more information about the file (Packed ID, Protocol, Severity,
Group, and Description). From here you can also decode the packet. For
more information see Error Scan, page 4-17.