Specifications

Troubleshooting Capturing Packets
19
ShoreTel Mobility Router Administration Guide 305
Capturing Packets
You can capture (dump) packet details on a specific interface by using the Packet Capture function.
To capture packets:
1. Select Troubleshooting > Packet Capture.
2. Select the Interface on which to capture the packets. Valid interfaces are Any, Eth0, Eth1 and lo
(loopback).
3. Select the Protocol to capture. The options are ARP, ICMP, TCP and UDP.
4. Enter number of packets to be captured. The range is 1-100000.
5. Enter the range of ports to be included in the capture in the Start and End fields.
6. Use the Capture Output area to view the capture. To send the details of the dump to a screen for
immediate viewing, click to Browser then click Start Capture. The following is an example of ARP
capture details:
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
13:15:13.770168 arp reply 192.168.3.20 is-at 00:30:48:63:02:cc 13:15:13.779377 arp
who-has 192.168.3.20 (Broadcast) tell 192.168.3.20 13:15:28.785852 arp reply
192.168.3.20 is-at 00:30:48:63:02:cc 13:15:28.793387 arp who-has 192.168.3.20
(Broadcast) tell 192.168.3.20 13:15:43.803708 arp reply 192.168.3.20 is-at
00:30:48:63:02:cc 13:15:43.812843 arp who-has 192.168.3.20 (Broadcast) tell
192.168.3.20 13:15:58.821968 arp reply 192.168.3.20 is-at 00:30:48:63:02:cc
13:15:58.830004 arp who-has 192.168.3.20 (Broadcast) tell 192.168.3.20
13:16:13.837083 arp reply 192.168.3.20 is-at 00:30:48:63:02:cc 13:16:13.844120 arp
who-has 192.168.3.20 (Broadcast) tell 192.168.3.20 13:16:17.598572 arp who-has
192.168.3.1 tell 192.168.3.136 13:16:28.852448 arp reply 192.168.3.20 is-at
00:30:48:63:02:cc 13:16:28.861481 arp who-has 192.168.3.20 (Broadcast) tell
192.168.3.20 13:16:43.868711 arp reply 192.168.3.20 is-at 00:30:48:63:02:cc
13:16:43.875797 arp who-has 192.168.3.20 (Broadcast) tell 192.168.3.20
13:16:51.004425 arp who-has 192.168.3.138 tell