topic Re: Packet capture on Secure Network Analytics 7.5.2 in Security Analytics

Packet capture on Secure Network Analytics 7.5.2

Antonio Macia — Fri, 02 May 2025 13:24:24 GMT

Hi,

When I try to run a packet capture on the FC GUI I get this message "Log in to your Manager, and follow the instructions in the Help to generate a packet capture. " If I go to that resource I see a bunch of CLI examples that are no longer usefull since SSH access is restricted on the latest versions. How can I run a packet capture on the GUI?

Thanks

Re: Packet capture on Secure Network Analytics 7.5.2

David Salter — Tue, 06 May 2025 08:12:43 GMT

What version are you using? Looking at 7.5.2, the process is as follows:

1: Log in to the appliance CLI using the sysadmin credentials, click OK in the Login information screen.

From the Main Menu select Advanced and click Select

From the Advanced menu select Packet Capture and click Select
Set your filter ensuring you set duration and number of packets and click Start

On completion, the success message provides help on accessing the file in addition to the file name. I note the 'The file is saved in /lancope/var/tcpdump' can be misleading, I'll raise that with the documentation team.

The file can be found by logging into the appliance web UI and click Support > Browse Files, then click the tcpdump folder.

The file can then be downloaded by clicking the filename.

I will check the help further for any errors, omissions or lack of clarity.

Re: Packet capture on Secure Network Analytics 7.5.2

Antonio Macia — Tue, 06 May 2025 08:59:35 GMT

Thanks @David Salter