Capture and search

Capuris Control separates recording from investigation. Capture settings determine what is written to disk; search settings create a smaller result from the stored PCAP data. Keep the original capture when an investigation requires a defensible source record.

Configure a capture port

Open the capture page and select a port. Before changing settings, verify the physical connector, link state, received packet counter, and available storage.

Use short files when operators need quick indexing and transfer. Use larger files when file-count overhead matters more. Test the chosen boundary under representative load.

WARNING Packet slicing permanently removes payload bytes beyond the selected length. Confirm that the remaining headers and payload are sufficient before enabling it on production evidence.

Apply capture filters

Filters reduce the data written to disk. They can preserve scarce capacity, but traffic excluded at capture time cannot be recovered later.

1. Enable filtering on the selected port.
2. Choose an unused filter number.
3. Set the priority when multiple rules may match.
4. Define the protocol, VLAN, address, or port criteria.
5. Decide whether unmatched traffic should also be captured.
6. Save the filter and review the resulting summary.
7. Generate both matching and nonmatching test traffic and confirm the result.

TCP and UDP rules may match a source port, destination port, or either direction. Use the narrowest rule that still answers the operational question. Document every persistent filter with its owner and reason.

Start and monitor recording

Review the port, directory, file prefix, rotation policy, slicing, and filters, then start capture. During the first few minutes, watch:

• capture state and elapsed time;
• packets and bytes received;
• packets dropped by the capture pipeline;
• file creation and growth;
• free storage and rotation behavior;
• adapter and link errors.

If drops increase, reduce the offered load or optional processing and confirm that the appliance was sized for the traffic. Do not treat a completed file as proof of lossless recording; the drop counters are the authoritative check.

Schedule a capture

Use the scheduler for a planned maintenance window or recurring observation period.

1. Set the start date and hour in the appliance time zone.
2. Set a duration long enough to include setup and rollback activity.
3. Choose the capture ports and confirm their storage settings.
4. Configure a remote backup target only if it has been tested separately.
5. Save the schedule and verify the pending job in the capture-progress view.

Avoid overlapping jobs that write the same port or exhaust the same storage pool. After the window, confirm that the job started, ended, and produced the expected files.

Merge multiple ports

Merged capture is useful for a bidirectional TAP or two observation points that share a timeline. Select the contributing ports, enable merge behavior, and choose one destination. Before relying on packet ordering, verify that all inputs use the same synchronized time source and that aggregate throughput remains within the supported capture profile.

Record the port mapping in the investigation notes so an analyst can distinguish traffic direction later.

Search packet history

Start with the smallest useful time range and add filters only as needed.

1. Select the source capture files or directory.
2. Set start and end timestamps, including the correct time zone.
3. Add known endpoints, VLANs, ports, protocols, or an expression.
4. Choose an output directory and a descriptive result name.
5. Set an output limit when a broad search could create a very large file.
6. Run the search and monitor its state.
7. Review the result table and open the packet viewer.

The packet viewer is appropriate for a quick inspection of timestamps, endpoints, protocol fields, and packet bytes. Export the result when deeper analysis or external sharing is required.

Search controls

Reordering can add processing time. Use it when chronological output matters, especially after merging files from several sources.

Write a focused expression

Begin with a simple condition, confirm that it matches, then add constraints. Representative BPF-style expressions include:

host 192.0.2.10
src host 192.0.2.10 and dst port 443
tcp and net 198.51.100.0/24
vlan 120 and udp port 53

Protocol support and extended syntax depend on the installed release. Test a new expression on known traffic before using it for an incident-wide search.

Manage capture files

The capture-file view lists recent PCAP data and its location. Use it to confirm file timestamps and size before a search or transfer. Index older files when the platform requires an index for efficient lookup.

WARNING Clearing a PCAP folder is destructive. Verify the exact directory, retention approval, backup state, and active capture target before deletion.

For uploads, choose the approved destination, transfer the PCAP, and wait for the file size to stabilize before indexing or searching it. For downloads, create a focused result whenever possible instead of transferring an entire retention set.

Compare network traces

Trace comparison helps identify where two captures begin to differ.

1. Choose synchronized captures of the same traffic from two points or two time periods.
2. Apply equivalent filters to both inputs.
3. Match flows using the available endpoint and protocol fields.
4. Compare packet presence, ordering, timing, retransmissions, and resets.
5. Save the comparison result with labels that identify location and time.

A packet present at one observation point but absent at the next narrows the loss domain. Packets present at both points with growing delay indicate where latency was introduced.

Create a latency report

Choose the relevant input, endpoints, time range, and protocol, then generate the report. Review sample count as well as minimum, average, percentile, and maximum values. A single average can hide bursts, so correlate outliers with the underlying packets and compare them with a healthy interval.

Replay traffic safely

Traffic replay transmits packets and can affect other systems. Use an isolated lab or an explicitly approved test segment.

1. Select a reviewed PCAP.
2. Choose the dedicated replay adapter.
3. Configure loop behavior only when repeated transmission is intentional.
4. Confirm cabling, destination, and expected rate.
5. Begin replay and watch adapter counters.
6. Stop replay before changing files, adapters, or topology.

Never replay captured production credentials or sensitive payloads into an environment that is not authorized to receive them.

Package investigation evidence

For each conclusion, retain:

• original capture location and immutable copy, when required;
• capture point, port alias, and time source;
• start and end time with time zone;
• search expression and output limits;
• focused PCAP and its checksum;
• screenshots or exported reports that support the finding;
• a short statement of observed and expected behavior.

For deeper visualization, continue with Insight analytics. For collection problems, use Support and troubleshooting.