topic Re: Packet capture in traffic log in General Topics

Packet capture in traffic log

Interface — Mon, 26 Aug 2013 06:12:21 GMT

Hello,

i have a hundreds pages of traffic log, how can i find captured packets? Searching for green arrows manualy is annoying, can i somehow use some filter or something?

Re: Packet capture in traffic log

UhMayYeah — Mon, 26 Aug 2013 07:14:00 GMT

Application PCAPs are generally enabled for Unknown apps : unknown-tcp or unknown-udp

You can use the following filter

( app eq unknown-tcp ) or ( app eq unknown-udp )

You can verify the capture settings using CLI command :

> show running application setting

Re: Packet capture in traffic log

Interface — Mon, 26 Aug 2013 07:48:26 GMT

Thank you for information. Clarifying the question: eg.: one day i capture "skype" packets. Now i have lot of traffic log with "skype" application and i don't remember the day, when i captured "skype" packets. How can i find now those packets (i can find manualy, but this is a waste of time)? Is any possibility to find all captured packets despite application?

Re: Packet capture in traffic log

UhMayYeah — Mon, 26 Aug 2013 07:52:09 GMT

(flags has pcap)

This should give you all the logs with PCAPs

Re: Packet capture in traffic log

Interface — Mon, 26 Aug 2013 08:11:35 GMT

That's it. Thank you very much!