To perform a TCP dump using the WUI, follow the steps below:

  1. In the main menu, select System Configuration > Troubleshooting.

  2. A TCP dump can be captured either by one or all Ethernet ports. In the TCP dump section at the bottom of the screen, select the relevant Interface to run the TCP dump on, or select All.
  3. Optionally enter the IP Address and the Port to be monitored.
    Note: To specify additional, optional parameters - use the Application Programming Interface (API) to perform a TCP dump. For further details, refer to the RESTful API documentation.
  4. Click Start.
  5. Make access from the client to the Virtual Server.
  6. When appropriate, click Stop.
  7. Click Download.
  8. This downloads the results of the TCP dump in a .pcap file. This file can be analysed using a packet trace tool such as Wireshark.

The TCP dump feature includes a few common filters, such as Interface, IP Address, and Port. By specifying an appropriate filter, the pcap can include the client to LoadMaster connectivity as well as the LoadMaster to server connection. Enter the Virtual Service's IP address as a filter for non-transparent Virtual Services. The client's IP address is a useful filter for transparent services. A port-based filter can also be used to narrow down the traffic that is recorded.

By default, the TCP dump captures the first 10,000 packets or 30MB of data. Depending on which value hit first, the capture will stop. The memory dedicated to save a pcap file is 30MB. When listening on two interfaces, each interface will be able to record up to 15MB of traffic.

If the logging of packets beyond 10,000 is required - it is possible to specify to record only the first n number of bytes of each packet. Therefore, the maximum packet count (-c) can also be increased.

Note: If you use the -c filter to capture more packets, the LoadMaster saves the pcap file to the /TMP folder. This folder size is very small and if you fill it up, you will lose access to the User Interface.