Can I capture packets on TR7 and download them as a pcap (tcpdump)?

Short answer

Yes, in two ways. A capture started in the tcpdump tab of the vService screen with Record as pcap turned on both flows live on the screen and is written to a pcap file; when the capture ends, the file appears as a download link at the top of the screen. The capture is filtered automatically by the vService's frontend addresses and Backend Services; it is narrowed with the client IP, port, protocol and an extra filter expression, and limited by duration (at most 30 minutes) and packet count. For a device-wide capture with free parameters, the sys-cmd tcpdump command is used with to-file in WEB-CLI. The files of both ways are kept in the temporary file area of WEB-CLI and stay until they are deleted.

Problem: Network-Level Evidence of the Problem Is Needed

Connection drops, TLS handshake errors or the behavior of the connections to the Backend Service cannot be explained with log records. The traffic needs to be captured as packets and examined with Wireshark or sent to the support team.

Solution: Two Methods

The two methods are alternatives to each other: tcpdump on the vService screen is used for the traffic of a vService, and WEB-CLI is used for a device-wide capture with a free filter.

Your situation	Suitable method
The traffic of a vService	Method 1: vService → tcpdump → Record as Pcap
Device-wide, free parameters	Method 2: WEB-CLI sys-cmd tcpdump

Method 1: vService → tcpdump → Record as Pcap Recommended

• How it works The capture is made on the vService's frontend addresses and Backend Services; while Record as Pcap is on, the same packets are written both to the screen and to the pcap file.
• Where it is opened Left Monitor Panel → Load Balancer vServices → vService → the tcpdump icon in the right panel header
• Requirement A running vService; space in the WEB-CLI temporary file area. Since the pcap file is served from the WEB-CLI file area, it can be downloaded only by a user whose User type is Admin.
• vService type HTTP · L7 TCP · Network

Step-by-Step Configuration

1

Adım 1 Open the vService screen

In the Left Monitor Panel, Load Balancer vServices is selected from the category selector and the vService is clicked (accessing the screen).

2

Adım 2 Open the tcpdump tab

The tcpdump icon in the header of the right panel, or tcpdump in the ⋮ menu to the right of the tab bar, is clicked; a closable tcpdump tab opens. When the tab is closed, the capture stops.

3

Adım 3 Open the start form

The Start button in the tab is clicked.

4

Adım 4 Set up the capture

The following fields are filled in on the form; the last used values are remembered per user:

Field	Values	Default
Duration	15s · 30s · 1m · 2m · 5m · 10m · 30m	30s
Inspection	Standard · Deep Inspection (tshark)	Standard
Record as Pcap	On · off	Off; turned on for a file
Frontends · Backend Servers	All · Select · Off (both cannot be Off at the same time)	All
Client IP Filter	Comma-separated IPs or CIDRs	Off
Port Filter	443 or 8000-8100	Off
Protocol	All protocols · TCP · UDP · ICMP	All protocols
Advanced Settings → Snap Length (bytes)	64 – 65535	256
Advanced Settings → Max Packets	100 – 200000	3000
Advanced Settings → Extra Filter Expression	A standard packet filter expression; applied together (AND) with the generated filter	Off

When Deep Inspection (tshark) is selected, the Deep Filters field filters by fields such as Host header, SNI, Request URI and Retransmissions; only the matching packets are shown on the screen, while the recording keeps all the traffic. This option is inactive if tshark is not present on the device.

5

Adım 5 Start the capture

The Accept button is clicked and the problem is reproduced. Capturing is written in the status field; the capture ends when the duration runs out or with Stop.

6

Adım 6 Download the file

The file is downloaded by clicking the capture-….pcap link that appears at the top of the screen (the download is done with a user whose User type is Admin); if the vService runs in more than one route table, the files come in a single .zip. If no packets were captured, no file is created. The screen output can also be taken as text with Export .txt.

7

Adım 7 Delete the file

The files are not deleted automatically; when the work is done, a user whose User type is Admin deletes the file with the sys-cmd file delete command in WEB-CLI (file delete).

Verification

1CaptureTR7 side

The status field in the tcpdump tab is checked.

ExpectedCapture finished · N and the capture-….pcap link

2FileClient side

The downloaded file is opened with Wireshark.

ExpectedThe captured packets are listed

Method 2: WEB-CLI sys-cmd tcpdump

• How it workssys-cmd tcpdump captures the packets passing through the interfaces of the route table selected in WEB-CLI; | to-file writes the output to a pcap file.
• Where it is opened TR7 WEB-CLI
• Requirement A user whose User type is Admin. For the traffic of another route table, that route table is selected first (route-table set).
• Scope Device-wide; not bound to a vService.

Step-by-Step Configuration

1

Adım 1 Capture to a file

The capture is started in WEB-CLI; in the example, 1000 packets are taken from the 443 traffic of the Backend Service with the address 192.0.2.10:

sys-cmd tcpdump -nn -i any -c 1000 host 192.0.2.10 and port 443 | to-file yakalama.pcap

The -w and -r parameters are not accepted; the only way to write to a file is to-file. If -c is not given, the capture continues until it is stopped, and no line comes to the screen while writing to the file. Since the | character splits the command, it is not used in the filter expression.

2

Adım 2 Download the file

The download link of the file is listed and the address in the Link column is clicked:

sys-cmd file show yakalama.pcap

3

Adım 3 Delete the file

When the work is done, the file is deleted:

sys-cmd file delete yakalama.pcap

Verification

1FileClient side

The downloaded file is opened with Wireshark.

ExpectedThe captured packets are listed

Common Mistakes

• Expecting a file without turning on Record as pcap. While recording is off, there is only the screen output and Export .txt.
• Expecting to read HTTPS content in the pcap. The content of TLS traffic is encrypted; the connection and the handshake are visible (things to know).
• Not deleting the files. The files stay in the temporary area; a single recording can be at most 512 MB, and if the temporary area fills up, new recording stops.
• Expecting packet content while the snap length is 256. For the full packet content, Snap Length (bytes) is increased.
• Assuming that the lines on a frontend shared with Virtual Hosting belong to a single vService. The traffic on the shared address belongs to all the vServices that use that address; it is narrowed with the Backend servers scope or the Client IP Filter.

How it is done in the documentation

• Dashboard · Panel Header (tcpdump)
• WEB-CLI tcpdump · Examples
• WEB-CLI file · File List

Related questions

• How do I follow a specific user's problem in live traffic?
• How do I download the encrypted diagnostic bundle for the support team (Encrypted Support Bundle)?
• How do I see the real client IP on the backend?
• How do I test from TR7 whether a server's port is reachable?