Run this during a maintenance window and take the help of Support if required. Note that this may cause performance impact due to the matching packets being handled by the CPU. An offloaded session will display 'layer7 processing: completed' in the show session details. Offloaded sessions can't be captured so offloading may need to be disabled temporarily.When filtering is enabled, new sessions are marked for filtering and can be captured, but existing sessions are not being filtered and may need to be restarted to be able to capture them.

This option should be used only if instructed by the support and on a low volume time of day as it will capture everything.

Pre-Parse Match is a feature that can capture all files before they are processed by the engines running on the dataplane, which can help troubleshoot issues where an engine may not be properly accepting an inbound packet.

Packets are captured on the dataplane vs on the interface (this explains the next bullet).Packet captures are session-based, so a single filter is capable of capturing both client2server and server2client.Four filters can be added with a variety of attributes.The first place to go is the Packet Capture menu on the GUI, where you can manage filters, add capture stages, and easily download captures.īefore we get started, there are a few things you should know:

Wireshark capture files download