Cloud Firewall provides a packet capture tool that allows you to capture network packets at the internet border for specific IP addresses and ports. This helps you quickly analyze packet content, diagnose network issues, review potential attacks, and identify security risks in your network communications. This topic describes how to use this tool.
Limitations
The packet capture feature is available for Cloud Firewall Enterprise Edition and Ultimate Edition. It is not supported for pay-as-you-go, Basic, or Premium editions. The daily quota of packet capture tasks for each Alibaba Cloud account is as follows:
-
Enterprise Edition: 20 per day
-
Ultimate Edition: 50 per day
Packet capture is supported only for traffic on the internet border.
If the source and destination IP addresses for a capture task are both within the same Alibaba Cloud region, traffic may not be captured. In this case, contact technical support.
Create a packet capture task
-
Log on to the Cloud Firewall console.
-
In the left-side navigation pane, choose .
-
In the Packet Capture section, click Capture Now.
-
On the Packet Capture page, click Create Packet Capture Task.
-
Configure the task parameters as described in the table below, and then click OK.
Parameter
Description
Task Name
Enter a descriptive name for the task.
Maximum Bytes
The maximum size of each packet to capture, in bytes. Packets larger than this value are truncated. Enter an integer up to 1048576.
Duration (s)
Specifies the task duration in seconds. The maximum allowed duration is 300 seconds for the Enterprise Edition and 600 seconds for the Ultimate Edition.
Protocol
The traffic protocol to capture. Valid values:
-
All
-
TCP
-
UDP
-
ICMP
IP Address Type
Select an IP address type.
-
IP: Capture packets sent to or from a single IP address. You can specify only one IP address.
-
IP Pair: Capture packets transmitted between a specified source and destination IP address pair. You can specify only one pair.
IP
The IP address for which to capture packets.
Port
The port for which to capture packets.
Peer IP Address
The peer IP address. This parameter is required only when IP address type is set to 'IP Pair'.
Peer Port
The peer port. This parameter is required only when IP address type is set to 'IP Pair'.
-
On the Packet Capture page, you can view the status of your tasks. A status of Completed in the Status column indicates the task has finished.
Download the captured data
-
On the Packet Capture page, find the completed task and click Download File.
When the task status is Completed, the Download File link appears in the Actions column.
-
After the download is complete, open the file to analyze the captured data. You can compare the data against your expected business traffic to identify potential security risks in your network traffic.