• SonicOS 7.0
• Using Packet Monitor
  • Benefits of Packet Monitor
  • How Does Packet Monitor Work?
  • Supported Packet Types
  • Configuring Packet Monitor
    • Configuring General Settings
      • Configuring General Settings
      • Configuring the Monitor Filter
      • Configuring Display Filter Settings
      • Configuring Logging Settings
      • Configuring Advanced Monitor Filter Settings
      • Configuring Mirror Settings
        • Starting and Stopping Packet Mirror
  • Monitoring Captured Packets
    • Starting and Stopping Packet Capture
  • Viewing Packet Monitoring Statistics
    • Capture Statistics
    • Local Mirror Statistics
    • Remote Mirror TX Statistics
    • Remote Mirror RX Statistics
    • FTP Statistics
    • Current Buffer Statistics
• Viewing Connections
  • Searching the Connections
  • Filtering the Connection Log
  • Connections Log Functions
• Monitoring Core 0 Processes
• Using Packet Replay
  • Single Packets
    • Packet Crafting
    • Packet Buffer
  • Replay Pcap File
    • Replaying an IP Pcap File
    • Replaying a MAC Pcap File
  • Captured Packets
    • About Captured Packets
    • Packet Detail
    • Hex Dump
• SonicWall Support
  • About This Document

Configuring General Settings

This section describes how to configure packet monitor general settings, including the number of bytes to capture per packet and the buffer wrap option. You can specify the number of bytes using either decimal or hexadecimal, with a minimum value of 64. The buffer wrap option enables the packet capture to continue even when the buffer becomes full, by overwriting the buffer from the beginning.

To configure the general settings

1. Navigate to the Monitor > Tools & Monitors > Packet Monitor page.
2. Select the General tab.

3. Select the Settings tab.

4. In the Number of Bytes To Capture (per packet) box, type the number of bytes to capture from each packet. The minimum value is 64 and the maximum value is 65535.
5. To continue capturing packets after the buffer fills up, select Wrap Capture Buffer Once Full. Selecting this option causes packet capture to start writing captured packets at the beginning of the buffer again after the buffer fills. This option has no effect if FTP server logging is enabled on the Logging tab, because the buffer is automatically wrapped when FTP is enabled.
6. Under Exclude Filter, select Exclude encrypted GMS traffic to prevent capturing or mirroring of encrypted management or syslog traffic to or from SonicWall GMS. This setting only affects encrypted traffic within a configured primary or secondary GMS tunnel. GMS management traffic is not excluded if it is sent through a separate tunnel.
7. Use the Exclude Management Traffic settings to prevent capturing or mirroring of management traffic to the appliance. Select the checkbox for each type of traffic (HTTP/HTTPS, SNMP, or SSH) to exclude. If management traffic is sent through a tunnel, the packets are not excluded.
8. Use the Exclude Syslog Traffic to settings to prevent capturing or mirroring of syslog traffic to the logging servers. Select the checkbox for each type of server (Syslog Servers or GMS Server) to exclude. If syslog traffic is sent through a tunnel, the packets are not excluded.
9. Use the Exclude Internal Traffic for settings to prevent capturing or mirroring of internal traffic between the SonicWall network security appliance and its High Availability partner or a connected SonicPoint. Select the checkbox for each type of traffic (HA, SonicPoint, BCP, Inter-Blade, or Back-Plane) to exclude.
10. To save your settings and exit the configuration window, click Save.