Wanguard 6.2 User Guide
Reports » Tools
Reports » Tools » Packet Tracers
Reports » Tools
contains a link to
Packet Tracers
when there is at least one Packet Sensor or Packet Filter in
use. The number of active packet traces is displayed within the panel.
Here you can easily capture packets from various parts of your network using distributed Packet Sensors.
You can view the contents of packets directly from Console using an integrated packet analyzer user interface that
resembles the popular WireShark software.
There are 2 sub-tabs located at the lower left side of the window:
Active Packet Traces
Administrators, operators, and guests with packet capturing privileges can generate packet dumps by
clicking the <
Capture Packets
> button. The options are:
●
Description
– An optional short description to help you identify the packet trace.
●
Packet Sensor
– Select which Packet Sensors can capture the traffic you are interested in. Administrators
can restrict which Packet Sensors are accessible by guest accounts.
●
BPF Expression
– Click the light bulb icon on the right to open a window that explains the Berkley Packet
Filter (BPF) syntax. Frequently used BPF expressions can be saved there and reused at a later time.
Entering a BPF expression is mandatory. To capture all IP traffic enter “ip”.
●
Max. Running Time
– The maximum running time of the capturing thread (process).
●
Stop Capture Time
– When Max. Running Time is set to “Unlimited”, you can set the exact date when
the capturing thread will stop.
●
Max. File Size (MB)
– The option is used for splitting packet dumps into multiple files of <number>
Mbytes. Before writing a raw packet to a file, the Packet Sensor checks whether the file is currently
larger than <number> and, if so, closes the current file and opens a new one.
●
Max. Packets
– The capture stops after receiving <number> packets.
●
Max. Files Number
– Setting this will limit the number of files created for the specified <number>, and
begin overwriting files from the beginning, thus creating a “rotating” buffer. In addition, it will name the
files with enough leading 0s to support the maximum number of files, allowing them to sort correctly.
●
Time Rotation (s)
– If specified, this rotates the file every <number> seconds.
●
Sampling Type & Value
– Select “None” when no packet sampling is required. Select “1 / Value” to save
just one packet every <value> packets. Select “Value / 5s” to save maximum <value> packets every 5
seconds.
●
Filename Prefix
–
The name of the capture file. If any file-rotation options are used, a number will be
appended to the filename.
●
Snapshot (bytes/pkt)
– Snarf <number> bytes of data from each packet rather than the default of 65535
bytes. Note that taking larger snapshots both increases the amount of time it takes to process packets
and, effectively, decreases the amount of packet buffering. This may cause packets to be lost. You should
limit this <number> to the smallest number that will capture the protocol information you are
- 84 -
Summary of Contents for wanguard 6.2
Page 1: ......
