Getting alert message "eth2 is capturing but the link status is down". The message could state any of the possible capture interfaces.
Example screenshot:
Mentioned ethernet port is not connected.
If you start capture on the ethernet port which is not connect to the appliance then you will get this message. If you click to dismiss the message it will popup again. This is normal behavior.
To fix this, stop capture on the ethernet interface mentioned in the notification message.
Click on the "Stop Capture" button. It will turn green once you click on the button (the red Stop Capture button becomes a green Start Capture button)
Note: It is recommended that you not enable capture on interfaces that receive no traffic. This can unnecessarily increase the overhead on the appliance.