SSLV packet capture contains data from interfaces that were not selected

book

Article ID: 168732

calendar_today

Updated On:

Products

SSL Visibility Appliance Software

Issue/Introduction

When using the CLD command capture select for packet capture, the capture includes data for interfaces that were not specified.

Example:

To select interfaces for packet capture, you do the following :
    sysadmin> capture select 1 4

However, when the packet capture is downloaded, you see that it contains data from other interfaces.

Cause

New interfaces are added to previously selected ones. They do not replace the previously selected interfaces until you run the command capture reset.

Resolution

When taking captures on different interfaces, always issue the capture reset command before starting a new capture. Otherwise, the new interfaces will be added to the previously specified interfaces.

See example below :
sysadmin> capture select 1 2 3
sysadmin> capture start

sysadmin> capture status
Capturing on interface(s) : 1 2 3
sysadmin> capture stop

sysadmin> capture select 4
sysadmin> capture start

sysadmin> capture status
Capturing on interface(s) : 1 2 3 4
sysadmin> capture stop

sysadmin> capture reset
sysadmin> capture status
Ready to configure and start capture
Selected interface(s) : NONE
Selected mode : normal


For information on how to perform a packet capture, see http://bluecoat.force.com/knowledgebase/articles/Solution/HowdoIrunapacketcaptureonSSLVappliance