Cisco Cisco Email Security Appliance C170 Guia Do Utilizador

The Support and Help > Packet Capture page in the GUI displays the list of complete packet capture files 
stored on the hard drive. When a packet capture is running, the Packet Capture page shows the status of 
the capture in progress by showing the current statistics, such as file size and time elapsed.

You can download a packet capture file using the Download File button and forward it in an email to 
Cisco IronPort Customer Support for debugging and troubleshooting purposes. You can also delete a 
packet capture file by selecting one or more files and clicking Delete Selected Files.

In the CLI, use the 

packetcapture

 command.

 shows the Packet Capture page in the GUI.

The packet capture feature is similar to the Unix 

tcpdump

 command.

To start a packet capture in the CLI, run the 

packetcapture

 > 

start

 command. If you need to stop a 

running packet capture, run the 

packetcapture

 > 

stop

 command. The appliance stops the packet capture 

when the session ends.

To start a packet capture in the GUI, select the Packet Capture option under the Support and Help menu, 
and then click Start Capture. To stop a running capture, click Stop Capture. A running capture started 
in the GUI is preserved between sessions.

The GUI only displays packet captures started in the GUI, not from the CLI. Similarly, the CLI only 
displays the status of a current packet capture run started in the CLI. Only one capture may be running 
at a time.

To edit the packet capture settings in the CLI, run the 

packetcapture

 > 

setup

 command.

To edit packet capture settings in the GUI, select the Packet Capture option under the Support and Help 
menu, and then click Edit Settings.