Packet Capture Module Verification

Confirm that the module you deployed is visible in the PCM UI User Interface. The visual components and controls that users interact with to access features and manage the system. and that capture and harvest The process of retrieving PCAP files from devices and transferring them to a customer-provided repository for analysis. work as expected.

To verify PCM:

1. Open the device list in PCM. See PCM device list.

2. After the module you just deployed is active, it should automatically show up in the PCM console within a few minutes.

   1. Confirm the device shows up in the PCM device list with the expected capture job settings.

3. Use the procedures in Packet Capture Module Operations for the operations below.

   1. If a capture job Writes network packets to local disk for continuous or on-demand captures. is not already running, click New Capture Job to start a new one.

      1. Use the Refresh data button to force the UI to query the device for the latest status. Otherwise, the screen auto-updates the status every minute.

      2. Shortly after starting the job you should see a status of Running.

      3. It may take two to three minutes before you see values in the Retention time and Size columns.

4. Let the capture run for 10 to 15 minutes.

5. Exercise the harvest function and confirm the PCAP Packet Capture. A file format that contains captured network packet data, typically used for network analysis and troubleshooting. was transferred to your repository.

   1. It may take two to three minutes for the harvest operation to complete.

   2. Use the Refresh data button to get a current status from the device.

6. When the harvest command completes, click the blue circle arrow next to the harvested PCAP file name to open a new browser window showing your customer-managed storage repository.

   Note: Your storage administrator will have had to grant you at least read access in order for you to open your repository and view harvested PCAP files.

   1. Access to your repository is not managed by Packet Capture Module.

7. Using your browser, download the PCAP to your laptop and open it in Wireshark (or any other protocol analysis tool that can process PCAP files).

8. Confirm it has the expected time period based on your harvest instructions.

9. Stop the capture job.

10. Delete the capture job.

11. Validation is complete.

12. If desired, start a new capture based on the capture profile of your choice.

13. Notify your account team that you have successfully tested PCM operations.

Next: Proceed to Production deployment to roll out PCM to additional devices.