You want to use the PacketShaper to capture packets for a specific host.

Follow the procedure below to use the PacketShaper to capture packets for a specific host:

1.  Access the PacketShaper using the command line interface (CLI). 
2. At the command prompt type the following command to remove any previous filters configured for your packet capture:
   packetcapture remove all
    
3. To add a host as the filter for your packet capture, type the following command:
   packetcapture add host:xx.xx.xx.xx
   
   Note: xx.xx.xx.xx is the IP address or domain name of an IPv4 host; IPv6 hosts are not supported.  
   Example of a valid host IP address:172.21.18.160
   Example of a valid host domain name: west.us.com
4. To check the packet capture details (including the packet capture file name and location), type the following command:
   packetcapture status
   
   Note: The packet capture status command can be run at any time before, during, and/or after the packet capture. 
5. To start the packet capture, type the following command:
   packetcapture on
6. Attempt to replicate the issue.
7. To end the packet capture, type the following command:
   packetcapture off

Note: The packet capture file will be created, named according to the day and time the packet capture was enabled, and stored in the 9.1026/pktlog directory on the Legacy PacketShaper and in the 9.258/pktlog directory on the PacketShaper S-Series with a .dmp file extension.

Follow the link below for more documentation regarding the packet capture feature for the Legacy PacketShaper:

• https://origin-symwisedownload.symantec.com/resources/webguides/packetguide/9.2/solutions/analysis/sniff-without-sniffer.htm

• https://origin-symwisedownload.symantec.com/resources/webguides/packetguide/11.6/index.htm#Topics/solutions/analysis/sniff-without-sniffer.htm