Error: "Packet size limited during capture" When Taking a Packet Capture From Symantec Director

Products

• Director

Issue/Introduction

Error: "Packet size limited during capture" when taking a packet capture from Symantec Director
You see "Packet size limited during capture" when taking a packet capture from Symantec Director

Resolution

 

By default, Director has a packet size limit to capture data on the wire. Larger packets than the packet size limit will show "Packet size limited during capture" when reading the packet capture. Taking a capture on larger packet sizes increases the processing time of packets.

If needed, you can increase the packet size limit before capture. For example:

director # tcpdump filter -s500
NOTE:  The above command will capture the first 500 bytes of each packet.  If you wish to capture the entire packet, please use the -s0 option.
 

GENERAL NOTES ON HOW TO TAKE A PCAP FROM A DIRECTOR DEVICE:

This information is provided in case you need to take a packet capture (pcap) from a Director appliance.

From the Director CLI:
Log in
Enable
Conf t

Taking a packet capture:
1. director (config) # tcpdump filter -s200
a. This sets the number of bytes to capture per packet; 0 captures full packet (-s0)

2. director (config) # tcpdump start

3. duplicate the issue

4. director (config) # tcpdump stop

5. Upload the pcap from Director to FTP or HTTP server (name: “sgmetcpdump”)
a. director (config) # tcpdump upload ftp://<hostname>/<path>/

NOTE: Either of these two options can be used....
http://<hostname[:port]>/<path>/
ftp://<hostname>/<path>/

If <path> ends with a directory name, it must end with /
(ex): tcpdump upload ftp://192.168.1.100/ftp-upload/