D-Link NetDefendOS

Downloading the Output File
As shown in one of the examples above, the -write option of pcapdump can save buffered packet
information to a file on the NetDefend Firewall.
These output files are placed into the NetDefendOS root directory and the filename is specified
in the pcapdump command line, usually with a filetype of .cap. The name of output files must
follow certain rules which are described below. Files can be downloaded to the local workstation
using Secure Copy (SCP) (see Section 2.1.7, “Secure Copy”). A list of all files in the NetDefendOS
root directory can be viewed by issuing the ls CLI command.
The -cleanup option will erase the files so cleanup should only be done after file download is
complete.
Output File Naming Restrictions
The name of the file used for pcapdump output must comply with the following rules:
• Excluding the filename extension, the name may not exceed 8 characters in length.
• The filename extension cannot exceed 3 characters in length.
• The filename and extension can only contain the characters A-Z, 0-9, "-" and "_".
Combining Filters
It is possible to use several of these filter expressions together in order to further refine the
packets that are of interest. For example we might want to examine the packets going to a
particular destination port at a particular destination IP address.
Compatibility with Wireshark
The open source tool Wireshark (formerly called Ethereal) is an extremely useful analysis tool for
examining logs of captured packets. The industry standard .pcap file format used by pcapdump
with its -write option means that it is compatible with Wireshark.
For more complete information about this topic, see http://www.wireshark.org.
Using pcap through the Web Interface
All the functions described above are available in the Web Interface by going to Status > Tools >
PCAP. It is also possible to directly download the .cap file to the management workstation. If
Wireshark has been installed and the file association with it set up, the file can be opened directly
in the software.
2.6.7. The traceroute Command
Overview
The NetDefendOS traceroute CLI command provides information about the routes that packets
take as they traverse the routers in the external network and the round-trip transit time to and
from these routers.
Traceroute functions by sending packets with a time-to-live (TTL) value that starts at 1 and is
Chapter 2: Management and Maintenance
128