Obtain a packet capture from a Mac computer using Terminal

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

You would like to diagnose a network issue and submit the packet capture to support.

Environment

Mac OS

Resolution

First, document the BSD Device Name:

1. Log in with your administrator username and password.

2. While holding down the Option key, select the Apple menu> Select System Information.

3. Select Network

4. Select Network Interface (Ethernet or Wi-Fi)

5. Under the details section, find "BSD Device Name." (example en0)

Then, proceed to capture the packet:

• Open your Applications folder> Utilities> Terminal,

• Type the following command (replace BSDname with your BSD device name) 

sudo tcpdump -1 BSDname -s 0 -B 524288 -w ~/Desktop/DumpFile01.pcap

• Press return, then enter your Admin username & password

Your Terminal should say  tcpdump: listening on... to indicate that it is listening for activity

• Leave the Terminal open.  Perform the network function you would like to test.

• When complete, return to the Terminal and press Control-C to capture the packet trace.  

• The trace will be saved to the desktop in a file named "DumpFile01.pcap"

• Email the file to your case

If you would like to see the contents, enter the following command:
tcpdump -s 0 -n -e -x -vvv -r ~/Desktop/DumpFile01.pcap