Configuring General Settings

This section describes how to configure packet monitor general settings, including the number of bytes to capture per packet and the buffer wrap option. You can specify the number of bytes using either decimal or hexadecimal, with a minimum value of 64. The buffer wrap option enables the packet capture to continue even when the buffer becomes full, by overwriting the buffer from the beginning.

To configure the general settings, complete the following steps:

Navigate to the Diagnostics > Packet Monitor page and click Configure.

In the Packet Monitor Configuration window, click the Settings tab.

Under General Settings in the Number of Bytes To Capture (per packet) box, type the number of bytes to capture from each packet. The minimum value is 64 and the maximum value is 65535.

To continue capturing packets after the buffer fills up, select Wrap Capture Buffer Once Full. Selecting this option will cause packet capture to start writing captured packets at the beginning of the buffer again after the buffer fills. This option has no effect if FTP server logging is enabled on the Logging tab, because the buffer is automatically wrapped when FTP is enabled.

Under Exclude Filter, select Exclude encrypted GMS traffic to prevent capturing or mirroring of encrypted management or syslog traffic to or from SonicWALL GMS. This setting only affects encrypted traffic within a configured primary or secondary GMS tunnel. GMS management traffic is not excluded if it is sent through a separate tunnel.

Use the Exclude Management Traffic settings to prevent capturing or mirroring of management traffic to the appliance. Select the check box for each type of traffic (HTTP/HTTPS, SNMP, or SSH) to exclude. If management traffic is sent through a tunnel, the packets are not excluded.

Use the Exclude Syslog Traffic to settings to prevent capturing or mirroring of syslog traffic to the logging servers. Select the check box for each type of server (Syslog Servers or GMS Server) to exclude. If syslog traffic is sent through a tunnel, the packets are not excluded.

Use the Exclude Internal Traffic for settings to prevent capturing or mirroring of internal traffic between the SonicWALL appliance and its High Availability partner or a connected SonicPoint. Select the check box for each type of traffic (HA or SonicPoint) to exclude.

To save your settings and exit the configuration window, click OK.