About Captured Packets

The Captured Packets page displays these statistics about each packet:

• # - The packet number relative to the start of the capture.
• Date & Time - The date and time that the packet was captured.

• Ingress - The firewall interface on which the packet arrived is marked with an asterisk (*). The subsystem type abbreviation is shown in parentheses. Subsystem type abbreviations are defined as:

  Abbreviation	Definition
  i	Interface
  hc	Hardware-based encryption or decryption
  sc	Software-based encryption or decryption
  m	Multicast
  r	Packet reassembly
  s	System stack
  ip	IP helper
  f	Fragmentation

• Egress - The firewall interface on which the packet was captured when sent out. The subsystem type abbreviation is shown in parentheses.

  Abbreviation	Definition
  i	Interface
  hc	Hardware-based encryption or decryption
  sc	Software-based encryption or decryption
  m	Multicast
  r	Packet reassembly
  s	System stack
  ip	IP helper
  f	Fragmentation

• Source IP - The source IP address of the packet.
• Destination IP - The destination IP address of the packet.
• Ether Type - The Ethernet type of the packet from its Ethernet header.

• Packet Type - The type of the packet depending on the Ethernet type; for example:

  Ethernet type	Packet type
  IP packets	TCP, UDP, or another protocol that runs over IP
  PPPoE packets	PPPoE Discovery or PPPoE Session
  ARP packets	Request or Reply

• Ports [Src, Dst] - The source and destination TCP or UDP ports of the packet.
• Length [Actual] - Length value is the number of bytes captured in the buffer for this packet. Actual value, in brackets, is the number of bytes transmitted in the packet.

• Status - The status field for the packet.

  The Status field shows the state of the packet with respect to the firewall. A packet can be dropped, generated, consumed, or forwarded by the firewall. Position the mouse pointer over dropped or consumed packets to show this information:

  Packet Status	Displayed Value	Definition of Displayed Value
  Dropped	Module-ID = <integer>	Value for the protocol subsystem ID
  	Drop-code = <integer>	Reason for dropping the packet
  	Reference-ID: <code>	SonicWall-specific data
  Consumed	Module-ID = <integer>	Value for the protocol subsystem ID