Packet Capture

XCO supports Packet Capture (PCAP) on 9920 and SLX devices.

PCAP captures packet data from the traffic that enters and leaves a device. The captured packets are stored in one or more PCAP files. After capturing the configured number of packets, packet capturing process automatically stops for the selected interface.

Ingress packets are captured before processing and egress packets are captured after processing, including header alterations.

You can use the data in PCAP files to monitor and analyze network traffic for information such as bandwidth usage, DNS resolution, network intrusion, and debugging.

• The packets received from data-path are written to the active PCAP file, pktcapture_running.pcapng.
• The active PCAP file is renamed and saved as pktcapture_N.pcapng, where N is 1-25.
• A maximum of 25 PCAP files with a file size of 100 MB each is supported for 9920. Packet capture automatically stops when 25 PCAP files are available. The existing PCAP files have to be removed to restart packet capture.
• The capture writes to the active PCAP file until file size reaches 100 MB. The PCAP file is then renamed and saved.
• Every SLX packet capture overwrites the previous PCAP file.
• If the capture is manually stopped, irrespective of the current file size, the active PCAP file is renamed and saved.
• (9920 only) XCO supports 10 simultaneous packet captures.