ZyXEL Communications ZyWALL USG100-Plus User Manual page 133

The ZyWALL uses the flash space to store packet capture files. Once the flash is full, the ZyWALL
stops generating the file or has new captured packets override old packets depending on your
setting. If your ZyWALL's flash is full or the size of the packet capture files you want to capture may
exceed the remaining space, you can use a USB storage device.
Note: You can check the remaining flash space in the Dashboard or Maintenance >
Diagnostics > Packet Capture screen.
To save packet capture files to a connected USB storage device, do the following:
Insert a USB storage device to any USB port on your ZyWALL. In the Monitor > System Status >
1
USB Storage screen, make sure the USB device's file system doesn't display "Unknown".
Go to Configuration > System > USB Storage, select Activate USB storage service and click
2
Apply.
In the Maintenance > Diagnostics > Packet Capture > Collect screen, select Save data to
3
USB storage.
6.9.1 Example of Viewing a Packet Capture (CAP) File
Here is an example of a packet capture file viewed in the Wireshark packet analyzer. Notice that the
size of frame 15 on the wire is 1514 bytes while the captured size is only 1500 bytes. The ZyWALL
truncated the frame because the capture screen's Number Of Bytes To Capture (Per Packet)
field was set to 1500 bytes.
ZyWALL USG100-PLUS User's Guide
Chapter 6 Maintenance
133