Stealthwatch flow collector additional BPF in pcap

[sammausing]

Is there any documentation for using the "additional BPF" field from packet capture utility on Stealthwatch Flow Collector.

Trying to find out are there any examples or syntax on how to use this field.

TIA

[kyoshiik · Accepted solution]

Please go to the online help of web UI. Right side top "?" at Support>Packet Capture.

And click "Configure Settings for capture Operation" > click "Tcpdump Expression".

You will see BPF options.

[sammausing]

Thank you :)