Configure a global packet capture

A global packet capture collects every packet that is sent to the ExtraHop system for the duration that matches the criteria.

  1. Log in to the Administration settings on the ExtraHop system through https://<extrahop-hostname-or-IP-address>/admin.
  2. In the Packet Captures section, click Global Packet Capture.
    When configuring packet captures, you only need to specify the criteria you want for the packet capture.
  3. In the Name field, type a name to identify the packet capture.
  4. In the Max Packets field, type the maximum number of packets to capture.
  5. In the Max Bytes field, type the maximum number of bytes to capture.
  6. In the Max Duration (milliseconds) field, type the maximum duration of the packet capture in milliseconds.
    ExtraHop recommends the default value of 1000 (1 second). The maximum value is up to 60000 milliseconds (1 minute).
  7. In the Snaplen field, type the maximum number of bytes copied per frame.
    The default value is 96 bytes, but you can set this value to a number between 1 and 65535.
  8. Click Start.
    Tip:Make a note of the time you start the capture to make it easier to locate the packets.
  9. Click Stop to stop the packet capture before any of the maximum limits are reached.
Download your packet capture.
  • On RevealX Enterprise systems, click Packets from the top menu and then click Download PCAP.

    To help locate your packet capture, click and drag on the Packet Query timeline to select the time range when you started the packet capture.

  • On ExtraHop Performance systems, click the System Settings icon , click All Administration, and then click View and Download Packet Captures in the Packet Capture section.
Last modified 2024-07-11