Chapter 4 Capturing and Decoding Packet Data

Files

Name:

Size:

Date:

State:

Location:

If you are using a Cisco 2200 Series appliance, the NAM will create a xxx.pcap file. If you click on the download button, a xxx.pcap file will be created regardless of whether you accept the download action or cancel it (a xxx.pcap file will be created once the download button is clicked). This is why one capture using an appliance could have an extra file compared with a capture from another NAM platform.

Table 4-6

Buttons in the Capture Files Operations Window

 

 

 

 

 

 

Operation

 

 

Description

 

 

 

 

 

 

Decode

 

 

Display the packets in a file.

 

 

 

 

 

 

Download

 

 

Download a file to your computer in .enc or .pcap file format.

 

 

 

 

 

 

 

 

 

 

 

Note

Do not add a file suffix when you provide the filename. The suffix

 

 

 

 

 

 

.pcap is added automatically.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Note

.capture to .pcap conversion will occur when you download a

 

 

 

 

 

 

capture file. You will need to manually delete the .pcap file when

 

 

 

 

 

 

it is done.

 

 

 

 

 

 

 

 

 

 

 

 

Rename

 

 

Give the file a new name. A dialog box displays and asks you to enter the

 

 

 

 

new name for the selected capture file.

 

 

 

 

 

 

Merge or

 

 

Merge packets of files.(in chronological order). A dialog box displays and

 

Convert/Merge

 

 

asks you to enter the new name for the merged capture files. Enter a name

 

 

 

 

for the merged capture files and choose OK.

 

 

 

 

 

 

 

 

 

 

 

Note

Merged files cannot exceed 2 GB.

 

 

 

 

 

 

 

 

 

 

On the Cisco NAM 2200 Series appliances, this button is called

 

 

 

 

“Convert/Merge.” This can be used to convert one .capture file to a .pcap

 

 

 

 

file, so the Error Scan and the Analyze functions can be performed on that

 

 

 

 

converted file. Otherwise, Analyze and Error Scan cannot be performed on

 

 

 

 

a .capture file which only shows up on appliances.

 

 

 

 

 

 

Delete

 

 

Delete files.

 

 

 

 

 

 

Analyze

 

 

View statistical analysis of the selected capture. See Analyzing Capture

 

 

 

 

Files, page 4-17.

 

 

 

 

 

 

Errors Scan

 

 

View more information about the file (Packed ID, Protocol, Severity,

 

 

 

 

Group, and Description). From here you can also decode the packet. For

 

 

 

 

more information see Error Scan, page 4-17.

 

 

 

 

 

 

 

 

 

User Guide for the Cisco Network Analysis Module (NAM) Traffic Analyzer, 5.0

4-16

OL-22617-01

Page 176
Image 176
Cisco Systems 5, NAM manual Display the packets in a file, Delete files