We need larger PCAP capability or a way to offload the PCAP’s running. On a Balance 20 for example PCAPS run for about 5 minutes at maximum. We need to run for at least 1 hour. This is extremely important for VoIP reasons. VoIP is becoming more and more important.
+1 on this - Packet capture capability for an extended time or a way to offload the capture to be saved at an external source would be greatly beneficial for many scenarios, especially VoIP
Balance 20 is designed for small office. The box will be overloaded if run Network Capture in longer time. I suggest to use sniffer (e.g. Wireshark) if longer time is needed.
I was actually wondering about this as well. Even though it is for small office, it’s not very useful for intermittent issues that we are trying to catch. Is there a way to offload the data in real time to an external server as to not take up all of the router’s memory? Would there be a way to use the USB port in the router and add a flash drive to store that data?
This is not possible now. Anyway 3rd party sniffer is highly recommended if high volume network capture is needed. Network Capture in support.cgi is used for specific troubleshooting purpose (eg. SIP Signalling flow), not for long time capturing.
We will have the remote capture support on coming 6.3.0 which allows you to capture packets going through the router to a PC running Wireshark. In that case, memory of the router shouldn’t create such big concerns. Rather your PC storage does instead. Stay tuned.
thanks this will help resolve issues much quicker then doing port mirring on switches
Thanks a lot!