pktcapture stack-node

This command captures packets of NS9500 and NS9600 Sensors configured in stack mode. Based on the Sensor configuration, you can capture packets on a single port or in port pair.

The captured packets are saved in the /tftpboot/capture.pcap file on the Sensor. The saved file is sent to the Manager or a SCP server based on the configuration made in the Manager. If you have configured the Manager to send captured packets to a SPAN port, you cannot capture packets by using this command.

Note

You can capture packets from the Manager as well. If the Manager is in the process of capturing packets, and at the same time, you run this command, the Sensor will display a message that a packet capture process is already running. Similarly, if you have started packet capture from the CLI, the Manager displays the packet capture Status as Running. In the Manager, you cannot stop a packet capture session that is started in the CLI and vice-versa. As a best practice, you should start and stop a packet capture session from the same place: either from the CLI or from the Manager.

Syntax

To capture packets on a single port:

pktcapture stack-node <stack_node_value> intfport <monitoring_port> <filter>

To capture packets in port pair:

pktcapture stack-node <stack_node_value> intfport-pair <monitoring_port1>-<monitoring_port2> <filter>

Applicable to:

NS9600 (stack) and NS9500 (stack)