Chapter 5 Managing the ACE Software
Capturing and Copying Packet Information
5-30
Cisco 4700 Series Application Control Engine Appliance Administration Guide
OL-11157-01
Capturing and Copying Packet Information
Capturing packets is a useful aid in troubleshooting connectivity problems with
the ACE or for monitoring suspicious activity. The ACE can track packet
information for network traffic that passes through the ACE. The attributes of the
packet are defined by an ACL. The ACE buffers the captured packets, and you can
copy the buffered contents to a file in Flash memory on the ACE or to a remote
server. You can also display the captured packet information on your console or
terminal.
This section contains the following topics:
•
Capturing Packet Information
•
Copying Capture Buffer Information
•
Viewing Packet Capture Information
Capturing Packet Information
To enable the packet capture function on the ACE for packet sniffing and network
fault isolation, use the
capture
command in Exec mode. As part of the packet
capture process, you specify whether to capture packets from all input interfaces
or an individual VLAN interface.
Note
The packet capture function enables access-control lists (ACLs) to control which
packets are captured by the ACE on the input interface. If the ACLs are selecting
an excessive amount of traffic for the packet capture operation, the ACE will see
a heavy load, which can cause a degradation in performance. We recommend that
you avoid using the packet capture function when high network performance is
critical.
The capture packet function works on an individual context basis. The ACE traces
only the packets that belong to the current context where you execute the
capture
Exec command. The context ID, which is passed along with the packet, can be
used to isolate packets that belong to a specific context. To trace the packets for a
specific context, use the
changeto
Exec command to enter the specified context
and then use the
capture
command.
