Capture PCAP with intermittent TCP errors (503) browsing web sites.
Last Updated June 05, 2018
TCP 503 errors were intermittently occurring on the browsers.
Error went away once page is being refreshed.
TCP 503 Error
As it would be difficult to capture an intermittent issue, following steps below would help in capturing the issue in PCAP.
Start PCAP with maximum PCAP buffer (see TECH245508)
Install the following CPL. This would automatically stop the PCAP when TCP error is seen by the proxy. (Refer to TECH241564 to install local policy)
You can then download the PCAP to troubleshoot the issue further. Best if you can correlate with the end user on which site, date, time and the symptom of the issue to better figure out the issue.
Note: you may add additional criteria to the above CPL to match only a certain traffic (Narrowing down the traffic is recommended as PCAP will be stopped if any user accidentally typed in a wrong address.
-This would stop PCAP if tcp_error is seen from the 10.30.147.76 IP address