Cisco Cisco Email Security Appliance C690 User Guide

Sometimes when you contact Cisco IronPort Customer Support with an issue, you 
may be asked to provide insight into the network activity going into and out of the 
Email Security appliance. The appliance provides the ability to intercept and 
display TCP/IP and other packets being transmitted or received over the network 
to which the appliance is attached.

You might want to run a packet capture to debug the network setup and to discover 
what network traffic is reaching the appliance or leaving the appliance.

The appliance saves the captured packet activity to a file and stores the file locally. 
You can configure the maximum packet capture file size, how long to run the 
packet capture, and on which network interface to run the capture. You can also 
use a filter to limit the packet capture to traffic through a specific port or traffic 
from a specific client or server IP address.

The Support and Help > Packet Capture page in the GUI displays the list of 
complete packet capture files stored on the hard drive. When a packet capture is 
running, the Packet Capture page shows the status of the capture in progress by 
showing the current statistics, such as file size and time elapsed.

You can download a packet capture file using the Download File button and 
forward it in an email to Cisco IronPort Customer Support for debugging and 
troubleshooting purposes. You can also delete a packet capture file by selecting 
one or more files and clicking Delete Selected Files.

In the CLI, use the 

packetcapture

 command.

 shows the Packet Capture page in the GUI.