Description

Data path debug was configured, but user is unable to see the PCAP file.
 
  • Configuration for packet capture: 

datapath-debug {

  capture-file mcap format pcap size 100m files 10;

  maximum-capture-size 10000;

  action-profile {

   do-mcap {

    event np-ingress {

     packet-dump;

    }

    event np-egress {

     packet-dump;

    }

   

    packet-filter mcap1 {

   action-profile do-mcap;

   source-prefix a.a.a.a/a;

   destination-prefix b.b.b.b/b;

   destination-port ccc;

  }

 

  packet-filter mcap2 {

   action-profile do-mcap;

   source-prefix a.a.a.a/a;

   destination-prefix b.b.b.b/b;

   source-port ccc;

 

  • Start the capture 

user@host> request security datapath-debug capture start

 

  • Stop the capture after a time interval 

user@host> request security datapath-debug capture stop

 

  • Checked if any data has been captured: 

show security datapath-debug capture 

 

Symptoms

Unable to see the PCAP file, it seems to be corrupted.

Solution

To view the results, from CLI operational mode, access the local UNIX shell and navigate to the directory /var/log/<file-name>. The result can be read by using the tcpdump utility.

user@host>start shell

%tcpdump -nr/var/log/e2e.pcap

Modification History

2024-02-06 : Article Created

Related Information

Using Packet Capture to Analyze Network Traffic

Configuring Data Path Debugging and Trace Options