User Experience Insight sensors allow for packet capturing to help dashboard users with remote troubleshooting and root-cause analysis.
There are two types of packet capture. Packet capture can be requested from a sensor “On-Demand”. Alternatively, if an issue is detected by a sensor, packet capture is dynamically captured and uploaded at the time of detection and is available for offline analysis. This is referred to as “Triage Packet Capture”. Both types of packet capture generate PCAP files that are available to download for 30 days.
Note: PCAP files are only available if the sensor has a connection to the UXI backend via Wi-Fi or ethernet. PCAP files will not be uploaded via a cellular connection.
On-Demand Packet Capture
An admin user can request an on-demand packet capture from the 'Company' section of the sensor status page.
Each sensor maintains a real-time rolling packet capture buffer. When requesting a PCAP file, the current rolling packet capture buffer on the sensor will be uploaded as a zipped file and you will receive a notification on the dashboard when finished.
The zip file contains:
A “default” packet capture with wireless 802.11 frames between the sensor and AP.
A “datagrams“ packet capture with wireless unencrypted sensor communication.
An “ethernet-default” packet capture (if applicable).
Triage Packet Capture
If the sensor runs a test and the test fails, the sensor will enter into an automated triage mode where it attempts to replicate the issue and perform root-cause analysis. During triage, the sensor uploads a packet capture which is attached to the issue report and available to access from the triage screen. This packet capture can be downloaded by pressing the "Download packet capture" button when examining the issue triage detail modal.
Triage packet captures are also made available as a single zipped file. The triage zip file will either contain the packet captures for the wireless or wired network, depending on which network the issue was detected on.
Advanced Settings
PCAP Type
In the sensor advanced settings page, there are two other options related to triage packet captures for the issue detail modal.
PCAP Light: The sensor will only upload a PCAP file on the first discovery of an issue.
PCAP Full: The sensor will upload a PCAP file on the first discovery and confirmation of an issue.
Disable Packet Capture
You can completely disable packet capture for all sensors under Settings -> Company -> Global Config and toggle the Packet Capture setting.
You can also disable packet capture for a single sensor from the Sensor Settings -> Advanced and selecting PCAP: Disable.