You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/network-watcher/packet-capture-manage.md
+18-16Lines changed: 18 additions & 16 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ author: halkazwini
6
6
ms.author: halkazwini
7
7
ms.service: azure-network-watcher
8
8
ms.topic: how-to
9
-
ms.date: 01/23/2025
9
+
ms.date: 01/24/2025
10
10
11
11
#CustomerIntent: As an administrator, I want to capture IP packets to and from a virtual machine (VM) so I can review and analyze the data to help diagnose and solve network problems.
12
12
---
@@ -25,7 +25,7 @@ In this article, you learn how to use the Azure Network Watcher [packet capture]
25
25
26
26
- Network Watcher Agent VM extension installed on the target virtual machine. Whenever you use Network Watcher packet capture in the Azure portal, the agent is automatically installed on the target VM or scale set if it wasn't previously installed. To update an already installed agent, see [Update Azure Network Watcher extension to the latest version](network-watcher-agent-update.md).
27
27
28
-
- An Azure storage account with VM outbound TCP connectivity to it over port `443`. If you don't have a storage account, see [Create a storage account using the Azure portal](../storage/common/storage-account-create.md?tabs=azure-portal&toc=/azure/network-watcher/toc.json). The storage account must be accessible from the subnet of the target virtual machine or scale set. For more information, see [Configure Azure Storage firewalls and virtual networks](../storage/common/storage-network-security?tabs=azure-portal&toc=/azure/network-watcher/toc.json).
28
+
- An Azure storage account with VM outbound TCP connectivity to it over port `443`. If you don't have a storage account, see [Create a storage account using the Azure portal](../storage/common/storage-account-create.md?tabs=azure-portal&toc=/azure/network-watcher/toc.json). The storage account must be accessible from the subnet of the target virtual machine or scale set. For more information, see [Configure Azure Storage firewalls and virtual networks](../storage/common/storage-network-security.md?tabs=azure-portal&toc=/azure/network-watcher/toc.json).
29
29
30
30
- Sign in to the [Azure portal](https://portal.azure.com) with your Azure account.
31
31
@@ -37,7 +37,7 @@ In this article, you learn how to use the Azure Network Watcher [packet capture]
37
37
38
38
- Network Watcher Agent VM extension installed on the target virtual machine. For more information, see [Manage Network Watcher Agent VM extension for Windows](network-watcher-agent-windows.md?tabs=powershell) or [Manage Network Watcher Agent VM extension for Linux](network-watcher-agent-linux.md?tabs=powershell).
39
39
40
-
- An Azure storage account with VM outbound TCP connectivity to it over port `443`. If you don't have a storage account, see [Create a storage account using PowerShell](../storage/common/storage-account-create.md?tabs=azure-powershell&toc=/azure/network-watcher/toc.json). The storage account must be accessible from the subnet of the target virtual machine or scale set. For more information, see [Configure Azure Storage firewalls and virtual networks](../storage/common/storage-network-security?tabs=azure-powershell&toc=/azure/network-watcher/toc.json).
40
+
- An Azure storage account with VM outbound TCP connectivity to it over port `443`. If you don't have a storage account, see [Create a storage account using PowerShell](../storage/common/storage-account-create.md?tabs=azure-powershell&toc=/azure/network-watcher/toc.json). The storage account must be accessible from the subnet of the target virtual machine or scale set. For more information, see [Configure Azure Storage firewalls and virtual networks](../storage/common/storage-network-security.md?tabs=azure-powershell&toc=/azure/network-watcher/toc.json).
41
41
42
42
- Azure Cloud Shell or Azure PowerShell.
43
43
@@ -53,7 +53,7 @@ In this article, you learn how to use the Azure Network Watcher [packet capture]
53
53
54
54
- Network Watcher Agent VM extension installed on the target virtual machine. For more information, see [Manage Network Watcher Agent VM extension for Windows](network-watcher-agent-windows.md?tabs=cli) or [Manage Network Watcher Agent VM extension for Linux](network-watcher-agent-linux.md?tabs=cli).
55
55
56
-
- An Azure storage account with VM outbound TCP connectivity to it over port `443`. If you don't have a storage account, see [Create a storage account using PowerShell](../storage/common/storage-account-create.md?tabs=azure-cli&toc=/azure/network-watcher/toc.json). The storage account must be accessible from the subnet of the target virtual machine or scale set. For more information, see [Configure Azure Storage firewalls and virtual networks](../storage/common/storage-network-security?tabs=azure-cli&toc=/azure/network-watcher/toc.json).
56
+
- An Azure storage account with VM outbound TCP connectivity to it over port `443`. If you don't have a storage account, see [Create a storage account using the Azure CLI](../storage/common/storage-account-create.md?tabs=azure-cli&toc=/azure/network-watcher/toc.json). The storage account must be accessible from the subnet of the target virtual machine or scale set. For more information, see [Configure Azure Storage firewalls and virtual networks](../storage/common/storage-network-security.md?tabs=azure-cli&toc=/azure/network-watcher/toc.json).
57
57
58
58
- Azure Cloud Shell or Azure CLI.
59
59
@@ -72,6 +72,8 @@ If a network security group is associated to the network interface, or subnet th
72
72
73
73
# [**Portal**](#tab/portal)
74
74
75
+
To start a capture session, use the following steps:
76
+
75
77
1. In the search box at the top of the portal, enter ***Network Watcher***. Select **Network Watcher** from the search results.
76
78
77
79
:::image type="content" source="./media/network-watcher-portal-search.png" alt-text="Screenshot shows how to search for Network Watcher in the Azure portal." lightbox="./media/network-watcher-portal-search.png":::
@@ -87,8 +89,8 @@ If a network security group is associated to the network interface, or subnet th
87
89
|**Basic Details**||
88
90
| Subscription | Select the Azure subscription of the virtual machine. |
89
91
| Resource group | Select the resource group of the virtual machine. |
90
-
| Target type | Select **Virtual machine** or . **Virtual machine scale set**. |
91
-
| Target virtual machine scale set | Select the virtual machine scale set. This option is available if you select Virtual machine scale set as the target type. |
92
+
| Target type | Select **Virtual machine** or **Virtual machine scale set**. |
93
+
| Target virtual machine scale set | Select the virtual machine scale set. <br> This option is available if you select **Virtual machine scale set** as the target type. |
92
94
| Target instance | Select the virtual machine or scale set instance. |
93
95
| Packet capture name | Enter a name or leave the default name. |
94
96
|**Packet capture configuration**||
@@ -114,7 +116,7 @@ If a network security group is associated to the network interface, or subnet th
114
116
115
117
:::image type="content" source="./media/packet-capture-manage/add-packet-capture.png" alt-text="Screenshot of Add packet capture in the Azure portal showing available options." lightbox="./media/packet-capture-manage/add-packet-capture.png":::
116
118
117
-
1. The packet capture will stop once the time limit or the file size (maximum bytes per session) is reached.
119
+
1. The packet capture stops once the time limit or the file size (maximum bytes per session) is reached.
118
120
119
121
# [**PowerShell**](#tab/powershell)
120
122
@@ -149,7 +151,7 @@ The following table describes the optional parameters that you can use with the
149
151
|`-TotalBytesPerSession`| Set the total number of bytes that are captured. Once the value is reached the packet capture stops. Up to 1 GB (1,073,741,824 bytes) is captured if not used. |
150
152
|`-LocalFilePath`| Enter a valid local file path if you want the capture to be saved in the target virtual machine (For example, C:\Capture\myVM_1.cap). If you're using a Linux machine, the path must start with /var/captures. |
151
153
152
-
The packet capture will stop once the time limit or the file size (maximum bytes per session) is reached.
154
+
The packet capture stops once the time limit or the file size (maximum bytes per session) is reached.
> If the storage account is in a different resource group than the virtual machine, use the full resource ID of the storage account instead of its name: `/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup2/providers/Microsoft.Storage/storageAccounts/mystorageaccount`.
166
+
> If the storage account is in a different resource group than the virtual machine, use the full resource ID of the storage account instead of its name such as: `/subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myResourceGroup2/providers/Microsoft.Storage/storageAccounts/mystorageaccount`.
165
167
166
168
---
167
169
168
170
## Stop a packet capture
169
171
170
172
# [**Portal**](#tab/portal)
171
173
172
-
To manually stop a packet capture session before it reaches its time limit, select the **...** on the right-side of the packet capture, or right-click it, then select **Stop**.
174
+
To manually stop a packet capture session before it reaches its time or file size limits, select the ellipsis**...** on the right-side of the packet capture, or right-click it, then select **Stop**.
173
175
174
176
:::image type="content" source="./media/packet-capture-manage/stop-packet-capture.png" alt-text="Screenshot that shows how to stop a packet capture in the Azure portal." lightbox="./media/packet-capture-manage/stop-packet-capture.png":::
175
177
176
178
# [**PowerShell**](#tab/powershell)
177
179
178
-
Use [Stop-AzNetworkWatcherPacketCapture](/powershell/module/az.network/stop-aznetworkwatcherpacketcapture) cmdlet to manually stop a running packet capture session.
180
+
To manually stop a packet capture session before it reaches its time or file size limits, use the [Stop-AzNetworkWatcherPacketCapture](/powershell/module/az.network/stop-aznetworkwatcherpacketcapture) cmdlet.
Use [az network watcher packet-capture stop](/cli/azure/network/watcher/packet-capture#az-network-watcher-packet-capture-stop) command to manually stop a running packet capture session.
192
+
To manually stop a packet capture session before it reaches its time or file size limits, use the [az network watcher packet-capture stop](/cli/azure/network/watcher/packet-capture#az-network-watcher-packet-capture-stop) command.
191
193
192
194
```azurecli-interactive
195
+
# Manually stop a packet capture session.
193
196
az network watcher packet-capture stop --location 'eastus' --name 'myVM_1'
194
197
```
195
198
@@ -206,7 +209,6 @@ Go to the **Packet capture** page of Network Watcher to list existing packet cap
206
209
207
210
:::image type="content" source="./media/packet-capture-manage/view-packet-capture.png" alt-text="Screenshot that shows how to list and see packet captures in the Azure portal." lightbox="./media/packet-capture-manage/view-packet-capture.png":::
208
211
209
-
210
212
# [**PowerShell**](#tab/powershell)
211
213
212
214
Use [Get-AzNetworkWatcherPacketCapture](/powershell/module/az.network/get-aznetworkwatcherpacketcapture) cmdlet to retrieve the status of a packet capture (running or completed).
@@ -257,7 +259,7 @@ The following example is the output from the `az network watcher packet-capture
257
259
258
260
# [**Portal**](#tab/portal)
259
261
260
-
After concluding your packet capture session, the resulting capture file is saved to Azure storage, a local file on the target virtual machine or both. The storage destination for the packet capture is specified during its creation. For more information, see [Start a packet capture](#start-a-packet-capture).
262
+
After concluding your packet capture session, the resulting capture file is saved to Azure storage, a local file on the target virtual machine or both. The storage destination for the packet capture is specified during its creation. For more information, see [Start a packet capture](#start-a-packet-capture) section.
261
263
262
264
To download a packet capture file saved to Azure storage, follow these steps:
263
265
@@ -280,7 +282,7 @@ To download a packet capture file saved to the virtual machine (VM), connect to
280
282
281
283
# [**PowerShell**](#tab/powershell)
282
284
283
-
After concluding your packet capture session, the resulting capture file is saved to Azure storage, a local file on the target virtual machine or both. The storage destination for the packet capture is specified during its creation. For more information, see [Start a packet capture](#start-a-packet-capture).
285
+
After concluding your packet capture session, the resulting capture file is saved to Azure storage, a local file on the target virtual machine or both. The storage destination for the packet capture is specified during its creation. For more information, see [Start a packet capture](#start-a-packet-capture) section.
284
286
285
287
If a storage account is specified, capture files are saved to the storage account at the following path:
After concluding your packet capture session, the resulting capture file is saved to Azure storage, a local file on the target virtual machine or both. The storage destination for the packet capture is specified during its creation. For more information, see [Start a packet capture](#start-a-packet-capture).
305
+
After concluding your packet capture session, the resulting capture file is saved to Azure storage, a local file on the target virtual machine or both. The storage destination for the packet capture is specified during its creation. For more information, see [Start a packet capture](#start-a-packet-capture) section.
304
306
305
307
If a storage account is specified, capture files are saved to the storage account at the following path:
0 commit comments