SonicOS 7.3 Monitor
Table of Contents
Using Packet Monitor
The Packet Monitor is a mechanism that allows you to monitor individual data packets that traverse your SonicWall network security appliance. Packets can be either monitored or mirrored. The monitored packets contain both data and addressing information.
Packet Monitor captures and displays packets dropped by Layer 2 MAC-IP Anti-Spoof enforcement on Native Bridge member interfaces and L2B interfaces. Previously, when firewalling was disabled on Native Bridge members, Layer 2 packets forwarded by the FDB were not visible in Packet Monitor even when they were being spoofed. With Layer 2 MAC-IP Anti-Spoof, dropped packets are now captured with full addressing information, including:
- Ingress Native Bridge member interface or L2B interface identification
- Source and destination MAC addresses
- Ethernet type (ARP, IP, etc.)
- Source and destination IP addresses (for IP packets)
- ARP sender/target MAC and IP (for ARP packets)
- Drop reason (L2 MAC-IP Anti-Spoof enforcement)
Dropped packets appear with the drop reason indicating Layer 2 MAC-IP Anti-Spoof enforcement, allowing administrators to:
- Verify that spoofing attacks are being blocked
- Identify the MAC address of the attacker
- Determine which Native Bridge member the attack originates from
- Confirm that legitimate traffic is not being incorrectly blocked
You can configure the packet monitor feature in the enhanced management interface. The management interface provides a way to configure the monitor criteria, display settings, mirror settings, and file export settings, and displays the captured packets.
Current configurations are displayed on this page, hover over the information symbols to view the details.
