Can Data Capture Files Generated on the Firewall be Opened with Wireshark?
12417
Created On 09/25/18 19:50 PM - Last Modified 05/31/23 20:24 PM
Resolution
Overview
No, the the data capture files are not in PCAP format. Therefore, they cannot be opened with Wireshark.
Details
When a data pattern is configured to match a type of traffic and the password for Manage Data Protection (Device > Setup > Content-ID) has been configured, a Data Filtering log captures the data that is triggered by the pattern.
A file (with a filename in the format similar to "20130911%2F10.32.1.77-61142-192.168.23.205-1080-207547") will be generated and can be downloaded. This file is not in a pcap format and cannot be viewed or opened with Wireshark, since the profile has an option to capture the data and not the packet.
owner: apasupulati