Secure Mobile Access 12.4 Administration Guide

Download PDF
Technical Documentation > Secure Mobile Access 12.4 Administration Guide > Appendix > Troubleshooting > Troubleshooting Tools in AMC > Capturing Network Traffic

Capturing Network Traffic

This network traffic utility, which is based on tcpdump, allows you to capture a packet-by-packet list of the data going in and out of the appliance. If you are new to troubleshooting, you can use this utility to generate a file of network traffic data that can be sent to Technical Support for troubleshooting network issues. If you are familiar with troubleshooting and reading trace files, you can analyze the traffic using a network protocol analyzer, such as Wireshark.

Capturing all network traffic on your appliance can quickly result in files that are too unwieldy to analyze. Where possible, use filters to restrict the traffic to issues you are troubleshooting.

Packet captures are saved on the appliance with a filename created from the date or time that the capture was performed. From 12.4.2 onwards, the description field is used to generate a filename. When the captures are downloaded from the appliance and sent to the support has a description to the filename, which makes it easy to understand.

  • If description of the capture contain non alpha-numeric chars, it is replaced with underscore.

    For example, if the file name has a description like Internal&External then filename would be .

  • If more than one capture contains same description, file names will be differentiated with the capture date and time.

  • If two different captures contain same description downloaded from two different appliances, capture filename will always start with appliance name to differentiate between them.

  • Only 30 characters are allowed for a filename. If the description is long, it is truncated.

The following sample procedure demonstrates how to filter by host and port (in this example, an Exchange server and Web traffic).

To filter and capture network traffic to a file on the appliance

  1. From the main navigation menu under Monitoring, click Troubleshooting.

  2. Click the Network Traffic tab.

  3. To restrict the capture to traffic coming from or going to your Exchange server, enter the server’s full qualified domain name or IPv4 or IPv6 address in the These hosts field. For example, exchange.mycompany.com.

  4. To make sure that you are capturing only the HTTP traffic, select Web (HTTP or HTTP/S) from the Common ports list; only traffic to and from the HTTP and HTTPS ports (80, 443, 8080, and 8443) will be captured.

  5. Click Start to begin capturing traffic. Enter a user-friendly filename or description.

    The size limit for a single capture is 500 MB of raw data; when the size of a capture file reaches 100 MB, it “rolls over” into a separate file (large files are difficult to process with packet analysis tools such as Wireshark). If the total size of a single capture reaches 500 MB (five files of 100 MB each), the capture automatically stops. During a capture, the Size column indicates how close you are to the limit.

  6. Click Stop to stop capturing traffic.

    The capture file is a .zip file that is stored on the appliance and listed here. (The figure in the Size column indicates how much room the file is using on the appliance; this is the size of the compressed .zip file, not the raw data.) The maximum number of files you can store is ten; as more capture files are added, the oldest ones are dropped from the list.

    A description added in the filename is displayed.

    Multiple captures can be created and stored in appliance. Observe that stored captures are displayed in a table view with checkbox for multiple selection.

    When multiple captures are selected, the Delete option is enabled. When a single capture is selected, both the Download and the Delete options are enabled.

    The limit for stored capture is 10 and not exceed 500 MB of size. The older captures can be deleted or downloaded.

  7. To download captured data, click the button corresponding to the file you want to analyze or send to Technical Support, and then click Download. Each capture file is a .zip file containing the captured network traffic (for example, eth0.cap) and a readme text file outlining what filters were used, if any, and when the data was captured.

    Comment: Internal interface, hosts: exchange.mycompany.com, selected ports

    Internal interface (eth0): enabled

    External interface (eth1): disabled

    Protocol: <All>

    Hosts: exchange.mycompany.com

    Ports: 80,443, 8080, 8443

    Start time: Wed Aug 15 2007 17:56:52 GMT

    Stop time: Wed Aug 15 2007 17:58:31 GMT

    Captured network traffic is not encrypted and may contain passwords and other sensitive information. If you have security concerns about storing a downloaded capture or sending it over an unsecured Internet connection, use Snapshot Tool in AMC instead. You can make a partial snapshot that includes only network captures, and then choose to encrypt the results. See Snapshot Tool for more information.

You can capture network traffic on either of the appliances in a high-availability pair (the master node or the slave node).

Was This Article Helpful?

Help us to improve our support portal

Yes! Not Really

Techdocs Article Helpful form

  • Hidden
  • Hidden

Techdocs Article NOT Helpful form

  • Still can't find what you're looking for? Try our knowledge base or ask our community for more help.
  • Hidden
  • Hidden