Packet capture in traffic log

[Interface]

Hello,

i have a hundreds pages of traffic log, how can i find captured packets? Searching for green arrows manualy is annoying, can i somehow use some filter or something?

[UhMayYeah]

Application PCAPs are generally enabled for  Unknown apps : unknown-tcp or  unknown-udp

You can use the following filter

( app eq unknown-tcp ) or  ( app eq unknown-udp )

You can verify the capture settings using CLI command :

> show running application setting

[Interface]

Thank you for information. Clarifying the question: eg.: one day i capture "skype" packets. Now i have lot of traffic log with "skype" application and i don't remember the day, when i captured "skype" packets. How can i find now those packets (i can find manualy, but this is a waste of time)? Is any possibility to find all captured packets despite application?

[UhMayYeah · Accepted solution]

(flags has pcap)

This should give you all the logs with PCAPs

[Interface]

That's it. Thank you very much!