• SonicOS 7.1
• About SonicOS
  • Working with SonicOS
  • SonicOS Workflow
  • How to Use the SonicOS Administration Guides
  • Guide Conventions
• Using Packet Monitor
  • Benefits of Packet Monitor
  • How Does Packet Monitor Work?
  • Supported Packet Types
  • Configuring Packet Monitor
    • Configuring General Settings
      • Configuring General Settings
      • Configuring the Monitor Filter
      • Configuring Display Filter Settings
      • Configuring Logging Settings
      • Configuring Advanced Monitor Filter Settings
    • Starting and Stopping Packet Mirror
  • Monitoring Captured Packets
    • Starting and Stopping Packet Capture
    • Configuring Mirror Settings
  • Viewing Packet Monitoring Statistics
    • Capture Statistics
    • Local Mirror Statistics
    • Remote Mirror TX Statistics
    • Remote Mirror RX Statistics
    • FTP Statistics
    • Current Buffer Statistics
• Viewing Connections
  • Filtering the Connection Log
  • Connections Log Functions
• Monitoring Core 0 Processes
• Using Packet Replay
  • Single Packets
    • Packet Crafting
    • Packet Buffer
  • Replay Pcap File
    • Replaying an IP Pcap File
    • Replaying a MAC Pcap File
  • Captured Packets
    • About Captured Packets
    • Packet Detail
    • Hex Dump
• SonicWall Support
  • About This Document

About Captured Packets

The Captured Packets page displays these statistics about each packet:

• # - The packet number relative to the start of the capture.
• Time - The date and time that the packet was captured.

• Ingress - The firewall interface on which the packet arrived is marked with an asterisk (*). The subsystem type abbreviation is shown in parentheses. Subsystem type abbreviations are defined as:

  Abbreviation	Definition
  i	Interface
  hc	Hardware-based encryption or decryption
  sc	Software-based encryption or decryption
  m	Multicast
  r	Packet reassembly
  s	System stack
  ip	IP helper
  f	Fragmentation

• Egress - The firewall interface on which the packet was captured when sent out. The subsystem type abbreviation is shown in parentheses.

  Abbreviation	Definition
  i	Interface
  hc	Hardware-based encryption or decryption
  sc	Software-based encryption or decryption
  m	Multicast
  r	Packet reassembly
  s	System stack
  ip	IP helper
  f	Fragmentation

• Source IP - The source IP address of the packet.
• Destination IP - The destination IP address of the packet.
• Ether Type - The Ethernet type of the packet from its Ethernet header.

• Packet Type - The type of the packet depending on the Ethernet type; for example:

  Ethernet type	Packet type
  IP packets	TCP, UDP, or another protocol that runs over IP
  PPPoE packets	PPPoE Discovery or PPPoE Session
  ARP packets	Request or Reply

• Ports [Src, Dst] - The source and destination TCP or UDP ports of the packet.

• Status - The status field for the packet.

  The Status field shows the state of the packet with respect to the firewall. A packet can be dropped, generated, consumed, or forwarded by the firewall. Position the mouse pointer over dropped or consumed packets to show this information:

  Packet Status	Displayed Value	Definition of Displayed Value
  Dropped	Module-ID = <integer>	Value for the protocol subsystem ID
  	Drop-code = <integer>	Reason for dropping the packet
  	Reference-ID: <code>	SonicWall-specific data
  Consumed	Module-ID = <integer>	Value for the protocol subsystem ID

• Length [Actual] - Length value is the number of bytes captured in the buffer for this packet. Actual value, in brackets, is the number of bytes transmitted in the packet.