diagnostic packet capture incomplete - any tips to improve?
Does anyone know how to improve the completeness of the diagnostic sniffer? Is there some system type setting that impacts this functionality?
I have noticed the output of the diagnostic sniffer often seems to only include session establishment type traffic, or perhaps it deliberately excludes in-session traffic (TCP obviously). I noticed this more often using capture level 4 (header and interface). Level 6 (bytes and interface) seems to more often include in-session traffic, but not in my current scenario.
The diagnose doco site does not mention anything about this although I'm sure I've seen disclaimers somewhere.
Currently I am fault-finding an application issue and packets I know are traversing a firewall are not being logged. I do see arp, session establishment and teardown, but not session traffic, and in this case I need to see that.
I am using commands of the form:
diagnose sniffer packet internal1 'host a.b.c.d' 6 0 aThe hardware is 60C, the unit is very lightly loaded (CPU usage is not an issue) and the traffic I'm trying to log is of the order of less than a packet per second.
