Packet Capture

Packet Capture is a process by which data packets are intercepted and recorded. Packet Capture operations reveal network performance and integrity issues such as congestion, packet loss, and security threats. Packet Capture results are stored in PCAP files that can be analyzed to obtain information required to address the issues revealed during packet capture operations.

Note

ExtremeCloud IQ stores PCAP files for 14 days. To retain PCAP files longer than 14 days, either download them to local storage or upload them to CloudShark. Uploading files to CloudShark requires an existing account.

ExtremeCloud IQ supports basic Packet Capture and Enhanced Packet Capture capabilities, as follows:

• All APs running IQ Engine OS support basic Packet Capture capabilities, which include:
  • View which packet capture operations are still in progress, and stop a packet capture session, if desired.
  • View all packet captures belonging to the same packet capture session grouped together.
  • Download PCAP files to a desktop PC or laptop.
  • Download PCAP files for each interface involved in a packet capture session, as well as files for the entire session combined.
• AP models AP5010/AP3000/AP3000X models hosting IQ Engine 10.6.4 or higher support basic Packet Capture capabilities as well as Enhanced Packet Capture capabilities, which include:
  • Set various filters to narrow the focus of the packet capture operation.
  • Capture wired and wireless packets simultaneously or independently.
  • If a client is specified, a user can:
    • Select all APs in the same location.
    • Select APs where the client has roamed over the previous 7 days.

Consider the following:

• Packet Capture is not supported on simulated devices.
• A device can participate in only one packet capture session at a time. However, multiple interfaces on the same device may participate in the same packet capture session.
• Each ExtremeCloud IQ license supports a maximum of 10 simultaneous packet capture sessions.
• When capturing data packets from a location, it is recommended that a MAC address filter be specified.
• If a client is specified only one MAC address filter can be used.
• After a packet capture starts, packet capture settings cannot be modified.