Error: "Packet size limited during capture" when taking a packet capture from Symantec Director You see "Packet size limited during capture" when taking a packet capture from Symantec Director
By default, Director has a packet size limit to capture data on the wire. Larger packets than the packet size limit will show "Packet size limited during capture" when reading the packet capture. Taking a capture on larger packet sizes increases the processing time of packets.
If needed, you can increase the packet size limit before capture. For example:
director # tcpdump filter -s500
NOTE: The above command will capture the first 500 bytes of each packet. If you wish to capture the entire packet, please use the -s0 option.
GENERAL NOTES ON HOW TO TAKE A PCAP FROM A DIRECTOR DEVICE:
This information is provided in case you need to take a packet capture (pcap) from a Director appliance.
From the Director CLI: Log in Enable Conf t
Taking a packet capture: 1. director (config) # tcpdump filter -s200 a. This sets the number of bytes to capture per packet; 0 captures full packet (-s0)
2. director (config) # tcpdump start
3. duplicate the issue
4. director (config) # tcpdump stop
5. Upload the pcap from Director to FTP or HTTP server (name: “sgmetcpdump”) a. director (config) # tcpdump upload ftp://<hostname>/<path>/
NOTE: Either of these two options can be used.... http://<hostname[:port]>/<path>/ ftp://<hostname>/<path>/
If <path> ends with a directory name, it must end with / (ex): tcpdump upload ftp://192.168.1.100/ftp-upload/
Imported Document ID: 000009272
Subscribing will provide email updates when this Article is updated. Login is required.