Connect the Packet Capture Module to a CIFS Share

Common Internet File System (CIFS) storage allows you to harvest PCAPClosed Packet Capture. A file format that contains captured network packet data, typically used for network analysis and troubleshooting. files to a remote CIFS or Server Message Block (SMB) share from a supported endpoint. Use this storage type when you want harvested files written directly to a network share rather than a cloud repository.

A CIFS Storage ProfileClosed A configuration that defines where the Packet Capture Module stores PCAP files, specifying the storage type and connection details for customer-managed repositories. contains only the CIFS Path (for example, \\remote-host\main\pcm_harvests\ or smb://remote-host/main/pcm_harvests). You cannot specify credentials in the storage profile. Authentication to the share is configured on the endpoint or file server, not in the storage profile itself.

Note: CIFS storage profiles appear only when you harvest from an endpoint whose OS family supports CIFS storage. CIFS harvests require endpoints running Packet Capture API v1.2 or later.

Set up guest write access to the CIFS share

Before you create a CIFS storage profile, an administrator must configure the remote share so that endpoints can write harvested PCAP files without supplying credentials in the storage profile. The exact steps depend on your file server platform, but the general workflow is as follows:

  1. Create a dedicated folder on the file server to receive harvested PCAP files.

  2. Share the folder over SMB/CIFS and record the UNC path (for example, \\fileserver\pcm_harvests).

  3. Configure share permissions so that the account used by the endpoint can create and write files in the share. For guest access, grant write permission to the guest or anonymous account supported by your environment.

  4. Configure NTFS or underlying file-system permissions on the folder so that the same account can create and modify files, but does not require read access to other content on the share unless your operational model requires it.

  5. On the file server, enable guest or anonymous SMB access if your security policy allows it. Many environments restrict guest access. If guest access is not permitted, configure the endpoint to authenticate to the share using a domain or local account that has write access, rather than relying on unauthenticated access.

  6. From a representative endpoint, verify that you can create a test file in the share using the same access method the Packet Capture Module will use during harvest.

Warning: Guest write access to a network share reduces access control over who can write files. Restrict the share to a dedicated folder, limit write permissions as tightly as your workflow allows, and monitor the share for unexpected content.

Creating a storage profile for a CIFS share

To create a CIFS storage profile:

  1. Navigate to the PCM Page:

    1. Click the Launchpad button ⁝⁝⁝.

    2. Click Network Observability > Packet Capture.

  2. Click the hamburger icon and select Packet Capture Configuration in the side bar.

  3. Click the Storage Profile tab.

  4. Click Create Storage Profile.

  5. Enter a profile name.

  6. Select CIFS Storage from the storage type dropdown.

  7. Enter the CIFS Path using smb://server/share, //server/share, or \\server\share format. The path must include both the server name and share name.

  8. Click Save. Your CIFS storage profile is now set up. You can specify this storage profile for future harvest commands.

CIFS storage profile configuration showing the CIFS Path field

After a harvest completes, use the chain icon in harvest history to copy the target path to the clipboard. For more information, see Lists of Harvests.