PCAP with only source IP Filter and Global counters

MP18 — Wed, 16 Jan 2019 03:09:07 GMT

Hi Everyone,

For certian cloud apps we do not know specific destination IP as users have given is list of urls and multiple subnets.

My question is if we do PCAP with only source IP as filter and then do the PCAP and check the global counters for error or

drops will we see right matched traffic as dropped in global counters?

To see right drops in global counters we whould filter via both source and destion ip ?

Re: PCAP with only source IP Filter and Global counters

LukeBullimore — Wed, 16 Jan 2019 14:23:29 GMT

Hey Mike,

Most of the time I test from some test laptop that has not much software on it (to reduce the chatter) then do the packet filter against the source IP and DST IP 0.0.0.0/0 to capture all destination traffic. If there is some issue with the cloud service and you see drops in the counters, likely they are related *but* not 100%.

The most full way of doing this would be to do an nslookup at the time to the cloud service to get the destination IP to use in your filter. Even though; yes, the IP address is dynamic, it should not be changing during the duration of your debugging.

Cheers,

Luke.

topic PCAP with only source IP Filter and Global counters in General Topics

PCAP with only source IP Filter and Global counters

Re: PCAP with only source IP Filter and Global counters