Merge pull request #229089 from James-Green-Microsoft/packet-caputre-fix

Fixes based on bug 537183

Author: v-ccolin

articles/private-5g-core/data-plane-packet-capture.md

@@ -12,7 +12,7 @@ ms.custom: template-how-to
 
 # Perform data plane packet capture for a packet core instance
 
-Packet capture for data plane packets is performed using the **UPF Trace (UPFT)** tool. UPFT is similar to **tcpdump**, a data-network packet analyzer computer program that runs on a command line interface. You can use this tool to monitor and record packets on any user plane interface on the access network or data network on your device.
+Packet capture for data plane packets is performed using the **UPF Trace (UPFT)** tool. UPFT is similar to **tcpdump**, a data-network packet analyzer computer program that runs on a command line interface. You can use this tool to monitor and record packets on any user plane interface on the access network (N3 interface) or data network (N6 interface) on your device.
 
 Data plane packet capture works by mirroring packets to a Linux kernel interface, which can then be monitored using tcpdump. In this how-to guide, you'll learn how to perform data plane packet capture for a packet core instance.
 
@@ -29,34 +29,31 @@ Data plane packet capture works by mirroring packets to a Linux kernel interface
 
 1. In a command line with kubectl access to the Azure Arc-enabled Kubernetes cluster, enter the UPF-PP troubleshooter pod:
 
-    `kubectl exec -it -n core core-upf-pp-0 -c troubleshooter -- bash`.
+    `kubectl exec -it -n core core-upf-pp-0 -c troubleshooter -- bash`
 
 1. View the list of interfaces that can be monitored:
 
-    `upft list`.
-
-1. Either:
-    - Run `upftdump` with any parameters that you would usually pass to tcpdump. In particular, `-i` to specify the interface, and `-w` to specify where to write to. Close the UPFT tool when done by pressing <kbd>Ctrl + C</kbd>.
-    - Or if you wish to enable packet capture and run tcpdump separately:
-        1. Enable packet capture by running `upft start <interface> <duration>`, where
-            - \<interface\> specifies the interface or interfaces to enable capture on. You can specify `any` to enable packet capture on all possible interfaces.
-            - \<duration\> specifies the time in seconds before packet capture automatically disables.
-        1. Type *yes* when prompted and then press <kbd>Enter</kbd> to continue.
-        1. Run `tcpdump` on the interface.
-        1. Once complete, run `upft stop <interface>` to disable packet capture if the timer has not expired.
+    `upft list`
+
+1. Run `upftdump` with any parameters that you would usually pass to tcpdump. In particular, `-i` to specify the interface, and `-w` to specify where to write to. Close the UPFT tool when done by pressing <kbd>Ctrl + C</kbd>. The following examples are common use cases:
+    - To run capture packets on all interfaces run `upftdump -i any -w any.pcap`
+    - To run capture packets for the N3 interface and the N6 interface for a single data network, enter the UPF-PP troubleshooter pod in two separate windows. In one window run `upftdump -i n3trace -w n3.pcap` and in the other window run `upftdump -i <N6 interface> -w n6.pcap` (use the N6 interface for the data network as identified in step 2).
+
+    > [!IMPORTANT]
+    > Packet capture files may be large, particularly when running packet capture on all interfaces. Specify filters when running packet capture to reduce the file size - see the tcpdump documentation for the available filters.
 1. Leave the container:
 
     `exit`
 
 1. Copy the output files:
 
-    `kubectl cp -n core core-upf-pp-0:<path to output file> <location to copy to> -c troubleshooter`.
+    `kubectl cp -n core core-upf-pp-0: <path to output file> <location to copy to> -c troubleshooter`
 
     The `tcpdump` may have been stopped in the middle of writing a packet, which can cause this step to produce an error stating `unexpected EOF`. However, your file should have copied successfully, but you can check your target output file to confirm.
 
 1. Remove the output files:
 
-    `kubectl exec -it -n core core-upf-pp-0 -c troubleshooter – bash rm`
+    `kubectl exec -it -n core core-upf-pp-0 -c troubleshooter –- bash rm <path to output file>`
 
 ## Next steps