Start packet capture on appliances

post

http://127.0.0.1:8080/tcpdump/run

Initiates packet capture (tcpdump) on one or more appliances. This is an asynchronous operation that queues capture tasks and returns a poll handle for tracking progress. Only one packet capture can run at a time; attempting to start another while one is in progress will result in an error.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

Configuration for the packet capture operation including target appliances, filters, and storage options.

Configuration for initiating a packet capture operation.

nePks

array of objects

required

List of appliance identifiers (nePks).

nePks*

max_packet

string

Defaults to 1000

Maximum number of packets to capture. Ignored when circularStorage is enabled.

string

Filter to capture only packets involving this IP address (source or destination).

port

string

^[0-9]{1,5}$

Filter to capture only packets on this port number (source or destination).

additionalOptions

string

Additional tcpdump filter expression (BPF syntax) for advanced filtering.

interfaces

array of objects

Defaults to []

List of specific interfaces/tunnels to capture on. If empty, captures on all interfaces.

interfaces

circularStorage

boolean

Defaults to false

Enable circular storage mode for continuous capture. When enabled, capture rotates through a fixed number of files.

maxSizePerFile

integer

≥ 1

Defaults to 100

Maximum size per capture file in MB when circular storage is enabled.

numberOfFiles

integer

≥ 1

Defaults to 5

Maximum number of capture files to maintain when circular storage is enabled.

snapLength

integer

≥ 1

Defaults to 100

Snapshot length - number of bytes to capture per packet. Lower values reduce file size but may truncate packet data.

Headers

string

enum

Defaults to application/json

Generated from available response content types

Allowed:

Responses

Language

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

text/html

application/json

200Successfully initiated packet capture. Returns a poll handle for tracking the asynchronous operation.

400Bad Request - Empty list of appliances provided.

500Internal Server Error - Packet capture already in progress or appliance communication failure.