The packet capture (PCAP) feature captures packet data from the traffic that enters and leaves a device and renders the data in a human-readable format.
You can enable PCAP on any physical port on supported devices. You can use the data in PCAP files to monitor and analyze network traffic for such information as bandwidth usage, DNS resolution, network intrusion, and debugging.
Ingress packets are captured before any processing occurs, such as actions that are defined by the policies you created. Egress packets are captured after all processing occurs, including header alterations.