Debug Using Pcap; Debug Using Remote Pcap - ASCOM Myco 3 Troubleshooting Manual

Troubleshooting Tools
5.7

Debug Using PCAP

The Packet Capture (PCAP) logs play a critical role in troubleshooting network-related issues. To
administrate a network, PCAP consists of an Application Programming Interface (API) for capturing network
traffic. The PCAP feature stores all the Wi-Fi traffic on a log in the handsets internal storage where it can be
extracted from.
With PCAP, you can sniff the network traffic on site and uplink the captured packets to a PC, where the
captured packets can be processed, analyzed and archived. The PCAP logs from the Network packet
logging are without encryption and can be opened, for example in Wireshark. The packet logging can also
be done while not being on the actual site, using Remote PCAP (RPCAP), see
PCAP, page 28.
Network packets in logs may be encrypted (for example, https or VPN traffic ), but the WLAN
encryption is removed.
Only run PCAP or RPCAP when needed, and shut it off when not used, if not done automatically by
timed logging. It gives additional load to the handset, as well as the system (with mirroring copies)
when using RPCAP.
Start Packet Logging from the Handset
1. Go into the Settings > Ascom settings > Troubleshooting > Network packet logging.
2. In the opened drop-down list, select Local.
Enabling Network packet logging starts tcpdump to log traffic on a network, and disabling
stops it. The stored files should be manually removed.
3. To turn off the Network packet logging, repeat the steps above, and select "Off" in the step 3.
Logs should be manually removed, otherwise the entire memory on the handset can be filled.
PCAP logs are limited to 10 files of 50 MB each. If the logs are full, the oldest file is deleted to
leave room for new data.
5.8

Debug Using Remote PCAP

With RPCAP you can run a packet capture program (the server) on a target computer, which sniffs the
network traffic on that system and uplinks the captured packets to another host (the client), where the
captured packets can be processed, analyzed and archived. To support remote captures, there is also an
implementation of the RPCAP protocol allowing captures to be made live from a remote host using, for
instance Wireshark.
Several handsets can be connected to the same Wireshark session to capture, for example,
transfer scenarios.
The packet logging can also be done while being on the actual site, using PCAP (for more information, refer
to 5.7 Debug Using PCAP , page
Start Remote Packet Logging from the Handset
To set up the handset for the RPCAP logging, do the following:
1. Go into the Settings > Ascom settings > Troubleshooting> Network packet logging.
2. In the opened list of options, select Remote.
28
28).
TROUBLESHOOTING GUIDE
5.8 Debug Using Remote
TD 93297EN / 19 December 2019 / Ver. B
Ascom Myco 3