Analyzing Captured Packets; Stopping The Packet Sniffing Service; Viewing Packet Sniffing Information - Avaya G250 Administration

Configuring monitoring applications
Capturing decrypted IPSec VPN packets
IPSec VPN packets are encrypted packets. The contents of encrypted packets cannot be
viewed when captured. However, you can use the capture ipsec decrypted command to
specify that IPSec VPN packets, handled by the internal VPN gateway process, should be
captured in clear text format.

Analyzing captured packets

Analyze the captured packets using the following steps:
1. Stop the packet sniffing service.
2. Optionally view information about the packet sniffing service and the captured packets
3. Upload the capture file.
4. Analyze the capture file.

Stopping the packet sniffing service

Use the capture stop command to stop the packet sniffing service. You must stop the
service in order to upload a capture file.
Note:
The capture stop command is not saved in the startup configuration file.
Note:

Viewing packet sniffing information

You can use the show capture command to view information about the packet sniffing
configuration and the capture state. For example:
G350-001> show capture
Capture service is enabled and inactive
Capture start time 19/06/2004-13:57:40
Capture stop time 19/06/2004-13:58:23
Current buffer size is 1024 KB
Buffer mode is cyclic
Maximum number of bytes captured from each frame: 1515
Capture list 527 on interface "FastEthernet 10/2"
Number of captured frames in file: 3596 (out of 3596 total captured frames)
Size of capture file: 266 KB (26.6 %)
Note:
The number of captured frames can be larger than the number of the frames in
Note:
the buffer because the capture file may be in cyclic mode.
294 Administration for the Avaya G250 and Avaya G350 Media Gateways