cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1394
Views
5
Helpful
2
Replies

Sourcefire PCAP

danlawrance1
Level 1
Level 1

Sourcefire Questions:

 

- How long do the events appear in the Intrusion-Events tab for you to be able to download the PCAP files? Is there a length of time these are visibile for or is there a limit on how many you can see/download?

 

- Once you have downloaded the PCAP file, does it still remain within the Intrusion-Events window?

 

Thanks

 

 

2 Replies 2

mikael.lahtela
Level 4
Level 4
Hi,

I have intrusion events from 2016, so they rotate depending on your setting under System/Configuration/Database/ under "Intrusion Event Database" and how many events you are getting.
The event will stay on the FMC after downloading it.

br, Micke

Thankyou! 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: