In the following
workflow, a network operator needs to troubleshoot a set of similar
authentication violations taking place at multiple branches. Because the
operator suspects that the authentication problems are due to a network attack
in progress, the operator runs the Packet Capture feature against the NAMs or
ASRs for each branch, then runs the Packet Decoder to inspect the suspicious
Create a capture
Monitor > Tools > Packet
Capture to create a new capture session definition.
section as needed. Give the session definition a unique name and specify how
you want to file the captured data. To capture the full packet, enter 0 in the
Packet Slice Size.
If you want
to restrict the captured traffic to particular source or destination IPs,
VLANs, applications, or ports, click Add in the Software Filters section and
create filters as needed. If you do not create a software filter, it captures
Devices area, you can select:
and its data ports. You can create one capture session per NAM only, whether
the capture session is running or not.
An ASR and its interfaces.
All Sessions. Prime Infrastructure saves the new session definition, then
runs separate capture sessions on each of the devices you specified. It stores
the sessions as files on the device and displays the list of packet capture
files in the Capture Files area.
To decode a
packet capture file:
Monitor > Tools > Packet
PCAP file in a NAM or ASR device.
To to copy the PCAP file to the PI server (the decode operation only runs on
files in the PI server).
Jobs to confirm that the copy job completed successfully.
localhost folder, select the check box for the new capture file, then click
Decode. The decoded data appears in the bottom pane.
A TCP Stream
displays the data as the application layer sees it. To view the TCP Stream for
a decoded file, select a TCP packet from the Packet List, then click TCP
Stream. You can view the data as ASCII text or in a HEX dump.
To run a packet
capture session again, select the session definition in the Capture Sessions area
Manage Jobs Using
the Jobs Dashboard
If you have the
appropriate user account privileges, you can manage
jobs using the Jobs dashboard. To view the
Jobs dashboard, choose
Administration > Dashboards > Job
Dashboard. From here, you can quickly see if a job
was successful, partially successful, or failed.
If too many jobs are
will hold other jobs in the queue until resources are available. If this delays
a scheduled job past its normal starting time, the job will not run. You will
have to run it manually.
Some jobs may
require approval. If this is the case,
sends an email to users with Administrator privileges notifying them that a job
was scheduled and needs approval. The job will only run after it is approved.
The following table
describes the buttons displayed in the
Table 1 Jobs
job from the
settings configured for the selected job.
the series schedule and lets you edit it (start time, interval, and end time).
Runs a new
instance of the selected job. Use this to rerun partially successful or failed
jobs; the job will only run for the failed or partially successful components.
currently-running job, but allows you to rerun it later. Not all jobs can be
will indicate when this is the case.
currently-running job and does not allow anyone to rerun it. If the job is part
of a series, future runs are not affected.
scheduled job series. When a series is paused, you cannot run any instances of
that series (using
scheduled job series that has been paused.
Series buttons are not available for system and poller jobs.
Jobs pane, choose a job series to get basic
information (such as job type, status, job duration, and next start time).
To view the job
interval, click a job instance hyperlink.
At the top of
the job page, the
Recurrence field indicates how often the job recurs.
To get details
about a failed or partially successful job, click the job instance hyperlink
and expand the entries provided on the resulting page.
especially helpful for inventory-related jobs. For example, if a user imported
devices using a CSV file (a bulk import), the job will be listed in the
Jobs sidebar menu under
Jobs > Device Bulk Import. The job details
will list the devices that were successfully added and the devices that were
To troubleshoot a
failed software image import job:
Jobs > Software Image Import from the
Jobs sidebar menu.
failed job in the table and then click its hyperlink.
job's details (if not already expanded) to view the list of devices associated
with the job and the status of the image import for each device.
To view the
import details for a specific device, click that device's
(information) icon in the
Status column. This opens an
Image Management Job Results pop-up window.
step and its status. For example, the
Collecting image with Protocol: SFTP column might
report that SFTP is not supported on the device.