Viewing PCAP information

From the PCAP Data toolbar menu, you can view a readable version of the data in the PCAP file or download the PCAP file to your desktop system.

Before you begin

Before you can view PCAP information, you must perform or select a search that displays the PCAP Data column.

About this task

Before PCAP data can be displayed, the PCAP file must be retrieved for display on the user interface. If the download process takes an extended period, the Downloading PCAP Packet information window is displayed. In most cases, the download process is quick and this window is not displayed.

After the file is retrieved, a pop-up window provides a readable version of the PCAP file. You can read the information that is displayed on the window, or download the information to your desktop system

Procedure

  1. For the event you want to investigate, choose one of the following options:
    • Select the event and click the PCAP icon.
    • Right-click the PCAP icon for the event and select More Options > View PCAP Information.
    • Double-click the event that you want to investigate, and then select PCAP Data > View PCAP Information from the event details toolbar.
  2. If you want to download the information to your desktop system, choose one of the following options:
    • Click Download PCAP File to download the original PCAP file to be used in an external application.
    • Click Download PCAP Text to download the PCAP information in .TXT format
  3. Choose one of the following options:
    • If you want to open the file for immediate viewing, select the Open with option and select an application from the list box.
    • If you want to save the list, select the Save File option.
  4. Click OK.