The number of the interface may vary depending on the network setup. Capture filters are based on BPF syntax, which tcpdump also uses. The names depend on the interface card type used. Capture vs Display Filters Further Reading Quicklinks: Wireshark Wiki User Guide pcap-filter manpage Capture Filters Capture filters are used to decrease the size of captures by filtering out packets before they are added. The external interface can be found by selecting the corresponding virtual host in the menu 'Application Firewall' - 'Reverse Proxy'. Typical names used for interfaces are eth0, eth1, vmnet1, etc.

There is a management interface, a back-end interface and one or more external interfaces. The management and back-end interface can be found in the menu 'System Setup' - 'Nodes' in the Airlock Configuration Center. The most important thing to know when recording network traffic are the names of the used network interfaces. Alternatively, you can use TShark, the command line version of Wireshark, directly. Traces recorded with tcpdump are compatible with other monitoring tools and analyzers like Wireshark.

To record such traffic on Airlock Gateway the common Linux tool tcpdump can be used. Search and Visualize - Exploring the data in detail or in aggregate. Protocol parsing - Parsing out the different network protocols and fields. This may be to analyze whether packets sent from external systems are reaching the Gateway, to check network connectivity, routing or firewall settings. Packet capture - Recording the packet traffic on a network. It is often useful to record network traffic on one of the interfaces attached to Airlock Gateway.

Tshark read pcap