Installing and using packet capture tools for the 8 and 9 series of the Layer 7 Gateway

Document ID : KB000009563
Last Modified Date : 14/02/2018
Show Technical Document Details
Introduction:

In some instances, it maybe necessary to capture and analyse network traffic received by and originating from the Gateway appliance. The Gateway appliance however, does not come with the necessary packages to do this by default. This article describes the steps required to install the necessary RPMs and the commands needed to generate a packet capture.

Instructions:
  1. Download the compressed archive attached to this article to a workstation.
  2. Upload the contents of the compressed archive to the Gateway appliance via SFTP or SCP as the ssgconfig user.
  3. Log into the Gateway appliance as the ssgconfig user
  4. Select Option #3: Use a privileged shell (root).
  5. Install the libpcap RPM: rpm -i -vh /path/to/libpcap-1.4.0-4.20130826git2dbcaa1.el6.x86_64.rpm
  6. Install the tcpdump RPM: rpm -i -vh /path/to/tcpdump-4.0.0-9.20090921gitdf3cb4.2.el6.x86_64.rpm

?Note: The value of "/path/to/" should be adjusted for the location of the file on the file system. By default, it should be /home/ssgconfig

Execution

A commonly used invocation of the tcpdump application is as follows: tcpdump -s 0 -i any -w /path/to/case.cap

  • The -s option specifies where the packet capture will start. This should always be "0."
  • The -w option specifies where the packet capture will be written to on the file system.
  • The -i option specifies an interface to perform a capture against. Valid options would be (but are not limited to): eth0, eth1, eth2, lo, or any

This application supports a wide array of options that are documented in the application's documentation or its formal manual page on the Gateway appliance. A cross-platform application exists to interpret and display packet captures in a human-readable format. Visit http://www.wireshark.org/download.html for more information.

Additional Information:

tcpdump_files.zip

File Attachments:
TEC0000001259.zip