How to use Packet Search
...
Choose PCAP files
...
for searching. There are two methods to select
...
files
...
:
Manually select files.
Select files
...
using Date and Time Search.
...
Optionally, specify the Filename and directory to save the search result.
Apply any necessary filters to narrow down the search criteria.
Click
...
the "Search" button
...
to initiate the search process.
Once completed, view the search results in the result window.
...
Packet Search Filters
| Table of Contents | ||||
|---|---|---|---|---|
|
Limit Output Search
Search results can be limited by Limiting search results is possible based on file size or packet count. By default, the FileSize option uses bytes. Using the options in the However, using the drop-down menu, you can choose to limit the size to KB, MB, or GB.
The packet-count option limits lets you restrict the number of packets in the output PCAP file. You can do this by entering a number up to 100M 100 million in the 'Packet Count Box'.
By Packet Count
By File Size
Packet Slicing (Bytes)
Packet Slicing speeds up analysis by minimizing data for quicker anomaly detection and security response, while also assisting privacy compliance by excluding sensitive information from captured packets.
Reorder Output PCAP
Selecting the “Reorder Output PCAP” allows you to create an output file, in which timestamps are ordered.
...
Expressions such as quantea.com, sip, and Santa Clara is all valid. You can also use Regular Expressions to search for particular strings.
Inline
...
Filter
Utilize Inline Search to filter packets based on according to source or destination IPv4 and IPv6 addressaddresses, source or destination Port number, and Protocol.port numbers, and protocol. Additionally, you have the option to upload a text file containing filter criteria to use as an inline search filter.
Filter String
Filter File
Upload Filter File
GTP Search
Packet Search can filter subscriber-specific sessions (both control plane and data plane) by correlating the subscriber-specific attributes such as MSISDN, IMSI, and/or LAI numbers and the control plane-related attributes. Identification of the subscriber’s user plane traffic is achieved by extracting the Tunnel Endpoint ID (TEID) in the control plane packets, which are correlated to the subscriber ID (IMSI) and subscriber end-point number (MSISDN).
...