Network Diagnostic Tools
61
ip
IP address (2-off)
Up to two IPs can be specified to
filter packets
self
Include my IP
By default any traffic to or from the
IP which is connecting to the web
interface to access pcap is excluded.
This option allows such traffic. Use
with care else you dump your own
dump traffic.
13.2.2. Security settings required
The following criteria must be met in order to use the packet dump facility :-
• You must be accessing from an IP listed as trusted in the HTTP service configuration (see Section 12.2).
• You must use a user and password for a "DEBUG level" user - the user level is set with the
level
attribute
on the
user
object.
Note
These security requirements are the most likely thing to cause your attempts to packet dump to fail. If
you are getting a simple "404" error response, and think you have specified the correct URL (if using
an HTTP client), please check security settings are as described here.
13.2.3. IP address matching
You may optionally specify upto two IP address to be checked for a match in packets on the interface(s) and/or
L2TP session(s) specified. If you do not specify any IP addresses, then all packets are returned. If you specify
one IP address then all packets containing that IP address (as source or destination) are returned. If you specify
two IP addresses then only those packets containing both addresses (each address being either as source or
destination) are returned.
IP matching is only performed against ARP, IPv4 or IPv6 headers and not in encapsulated packets or ICMP
payloads.
If capturing too much, some packets may be lost.
13.2.4. Packet types
The capture can collect different types of packets depending on where the capture is performed. All of these
are presented as Ethernet frames, with faked Ethernet headers where the packet type is not Ethernet.
Table 13.2. Packet types that can be captured
Type
Notes
Ethernet
Interface based capture contains the full Ethernet
frame with any VLAN tag removed.
IP
IP only, currently not possible to capture at this level.
An Ethernet header is faked.
PPP
PPP from the protocol word (HDLC header is ignored
if present). An Ethernet header is faked and also a
PPPoE header. The PPPoE header has the session
PPPoE ID that is the local end L2TP session ID.
The faked protocol header has target MAC of 00:00:00:00:00:00 and source MAC of 00:00:00:00:00:01 for
received packets, and these reversed for sent packets.
