Белая книга для Cisco Cisco Prime Infrastructure 3.0

 

 

© 2015 Cisco and/or its affiliates. All rights reserved. This document is Cisco Public Information. 

Page 61 of 83 

There are times when you want to capture packets based on a trigger. There is no way to find out ahead of time 

when the trigger will happen. For example, if you are trying to meet the SLA for AvgRespTime for an application, 

you may want to start the packet capture if the response time exceeds the predefined time. You can easily achieve 

this by combining threshold and packet capture in Cisco Prime Infrastructure. Navigate to Design > Monitoring 

Configuration > Features > Thresholds. When you click a threshold template, you can create a new instance 

from it. Besides the header information, you can select thresholds based on your interest from Traffic Analysis, 

Application, Voice/Video Signaling, Voice/Video Data, Interface Health, Device Health, and NAM Health. It would 

be a good idea to explore these options and see what types of trigger points each of them has. Once you select the 

category for capture, you can then select the subcategory. All the trigger points can then be seen. In order to 

change any of them, simply select that row and edit the threshold as shown in the image above. You can see 

(figure above) that we have chosen to alert and start capturing Sharepoint traffic if the AvgRespTime exceeds the 

default value. 

Once the packets are captured, there are two options to decode the capture. The easiest way is to select the 

packet capture session and click Decode from the Packet Capture homepage (Operate > Packet Capture). The 

capture decode is shown in a pop-up window, which makes it extremely easy to evaluate each and every packet as 

shown in the figure below. 

You could also click the Export button and the .pcap file will be downloaded directly on the client PC. This is useful 

if you need to perform advance troubleshooting on the capture decode. There is a dimmed Merge button between 

the Decode button and the Export button, which can be used to merge the .pcap files if more than one file is 

selected. 

 TIP: if the capture file is not very large (that is, not on the order of GB), it makes sense to decode it in Cisco 

Prime Infrastructure instead of jumping over to the NAM. Otherwise, you should use NAM instead of Cisco Prime 

Infrastructure for decoding very large capture files.