diagnose sniffer packet
SafePacket sniff
diagnose sniffer packet <if> '<filter>' 4
Observes traffic on an interface with a filter to triage connectivity.
Examples
diagnose sniffer packet any 'host 8.8.8.8' 4Sniff traffic to a hostdiagnose sniffer packet any 'host 192.168.1.50 and port 443' 4 100Capture 100 HTTPS packetsdiagnose sniffer packet port1 'icmp' 4ICMP on port1 onlydiagnose sniffer packet any 'host 10.0.0.5 and port 53' 4 50Capture 50 DNS packets for one hostdiagnose sniffer packet any 'host 192.168.1.50' 6 0 lShow packet contents with local timestamps
Syntax
diagnose sniffer packet <if> '<filter>' <verbose> [count]
Key points
- Verbose level 4 shows the ingress and egress interface for each packet, which is what you need for isolation.
- If packets come in but never leave, a policy or route is dropping them. Use diagnose debug flow to see why.
- Stop with Control+C, or set a count to stop automatically.
When it does not work
- If nothing appears, the filter may be too narrow, or the traffic is offloaded to the NPU. The first packets of a session pass through the CPU and show up; the rest do not. Temporarily set auto-asic-offload disable on the policy.
- Always set auto-asic-offload enable again afterwards, or CPU load stays high.
Before you run it
Read-only but can be load-heavy.
Related commands
- get system performance statusPerformance status
- tcpdumpCapture packets
- diagnose debug flowDebug flow
You can carry a laptop to the rack. Signal will not follow.
Check syntax standing in front of the hardware, with no connection at all. The app keeps 1,510 commands and 120 fix flows on your device. Free to install, no ads (some content is a one-time purchase).
Get it free on the App Store