Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

SA-540 packet trace issue

I have encountered a strange issue with packet tracing on multiple SA-540 units. Regardless of the firmware version (tried 1.1.42 and 1.1.65) or the interface, the build-in "Packet Trace" diagnostics only produced a crippled trace file at the end. As it seems, there are always about ~1500 packets or less contained in the dump (that means about 5-10 seconds of traffic on our network line where we tested last time), and the dump file itself is always smaller than 1MB. Tracing back to only 5 seconds is simply not long enough when troubleshooting a network problem! Did anyone else experience this issue? Does anyone know if this is a bug or a limit of the SA-540? If the second option is true, then it is a serious drawback on the usability of this device!

Cisco Employee

Re: SA-540 packet trace issue

Hi Peter,

The SA-500 series devices are indeed limited in the ability to capture packets.  The devices have a limit to the buffer size of the packet trace given the amount of memory available to the routers.  If your debugging scenarios require larger captures, do make use of the SA 500's ability to port mirror on the LAN side, and you can perform larger WAN captures by placing an intermediate device(HUB) on front of your WAN interface, and capturing there.

I will ask development if we can increase the buffer size, since the scans are made on-demand while debugging.

Best regards,