The ProxySG appliance captures PCAP files in large packet sizes because of TCP segmentation offloading, which is a feature that increases the amount of output for high workload network connections. For TCP segmentation offloading, the PCAP capture point occurs within the NIC interface, before the segmentation of data into packets occurs. The following is an example of a PCAP file:
93357 09:28:44 Client ProxySG HTTP GET http://image.itmedia.co.jp/mn/articles/1510/07/hi_sh05.jpg HTTP/1.1 611 55734 3080 1293
93358 09:28:44 ProxySG Client HTTP HTTP/1.1 200 OK (JPEG JFIF image)[Packet size limited during capture] 7005 3080 55734 1293
93359 09:28:44 ProxySG Client TCP 3080→55734 [PSH, ACK] Seq=106653 Ack=3265 Win=65535 Len=8192[Packet size limited during capture] 8246 3080 55734 1293
93360 09:28:44 ProxySG Client TCP 3080→55734 [PSH, ACK] Seq=114845 Ack=3265 Win=65535 Len=8192[Packet size limited during capture] 8246 3080 55734 1293
93361 09:28:44 ProxySG Client TCP 3080→55734 [ACK] Seq=123037 Ack=3265 Win=65535 Len=3865[Packet size limited during capture] 3919 3080 55734 1293
93389 09:28:44 Client ProxySG TCP 55734→3080 [ACK] Seq=3265 Ack=112093 Win=15405 Len=0 60 55734 3080 1293
ProxySG S400 and S500 models can capture PCAP files when the NIC speed is 10GBps.