Export and Download Packet Capture Files

You can export PCAP files on the NSX Manager and then download the exported files.

The Packet Capture Query page displays a list of PCAP (packet capture) files. Each file has an associated ID, event, signature, and node for which the file is captured. You can export 50 PCAP files in one TAR file and download a maximum of 20 such TAR files per host on the NSX Manager. The exported files are available for download on the NSX Manager for 24 hours from the time of export.

Procedure

1. Navigate to Security > IDS/IPS.
2. Click the Packet Capture Query tab.
3. Select the PCAP files that you want to export.
4. Click Export Packet Capture Data.
   The message bar shows the export progress and information about any previous downloads.
5. Click the View Details link on the message bar to view details of the exported files.
6. Click Download to download any TAR file.
7. To view signatures and PCAP files details in any exported TAR file, click the links in the respective columns.