Error code "1008:: Packet Capture is down" and Network Monitor status "Unknown" in DLP
Article ID: 160019
Data Loss Prevention EnforceData Loss Prevention
Network Monitor status unknown in Symantec Data Loss Prevention (DLP).
Error code 1008:: Packet Capture is down
Verify that the correct version of WinPcap is installed and is running on the Network Monitor server. Check the DLP Installation Guide for the correct version of WinPcap.
Verify connectivity between the Enforce and Network Monitor server using ping.
Use netstat -aon | findstr "8100" from Enforce to Network Monitor server and vice versa. 8100 is the communication port between Enforce and the Detection Server. This is the port that MonitorController uses to communicate.
Check the MonitorController logs (on Enforce) and the PacketCapture logs (on the Network Monitor) for further reference. Note: for RHEL, use netstat -aon | grep 8100