startOrgPacketCapture
Start an organization-level packet capture for org-level Mist Edges
NOTE: For packet captures of org level Mist Edges only. Use Start Site Packet Capture for site level Mist Edges.
The output will be available through websocket. As there can be multiple commands issued against the same AP at the same time and the output all goes through the same websocket stream, session is introduced for demux.
Subscribe to Device Command outputs
WS /api-ws/v1/stream
{ "subscribe": "/orgs/:org_id/pcaps"}Response (MxEdge)
{ "event": "data" "channel": "/orgs/67970e46-4e12-11e6-9188-0242ac110007/pcaps" "data": { "capture_id": "f039b1b4-a23e-48b2-906a-0da40524de73", "pcap_dict": { "dst_mac": "68:ec:c5:09:2e:87", "src_mac": "8c:3b:ad:e0:47:40", "vlan": 1, "src_ip": "34.224.147.117", "dst_ip": "192.168.1.55", "dst_port": 51635, "src_port": 443, "protocol": "TCP", "mxedge_id": "00000000-0000-0000-1000-001122334455", "direction": "tx", "timestamp": 1652247615, "length": 159.0, "lost_messages": 0, "interface": "port0", "info": "1652247616.007409 IP ec2-34-224-147-117.compute-1.amazonaws.com.https > ip-192-168-1-55.ec2.internal.51635: Flags [P.], seq \n 2192123968:2192124057, ack 4035166782, win 12, options [nop,nop,TS val 597467050 ecr 740580660], length 89\\n", }, "pcap_raw": "1MOyoQIABAAAAAAAAAAAAP//AAABAAAAQEx7YhMzAACfAAAAnwAAAGjsxQkuh4w7reBHQIEAAAEIAEUAAI1bLEAAKAZ/CiLgk3XAqAE3AbvJs4KpKEDwg8I+gBgADFf9AAABAQgKI5yfqiwkXTQXAwMAVKY5JopoKQrVEn0/3ld4YntctGEH/rTZuwtCvzSncFw71QJveJi9uxHs57KC8w9Apph3YvXJrmWg7M37+o+YV0KH/xmr626s5Bkhb3QhKOu+NoNEmA==" }}Stop Response
{ "event": "data" "channel": "/orgs/67970e46-4e12-11e6-9188-0242ac110007/pcaps" "data": { "capture_id": "a2f7374d-6a70-41fd-8a3f-71e42573baaf", "pcap_dict": null }}Preferred authentication method for automation and integrations. Send the API token in the HTTP Authorization header.
Format:
Authorization: Token {apitoken}
Notes:
- An API token generated for a specific admin has the same privileges as that admin
- An API token is automatically removed if it is not used for more than 90 days
- SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed.
In: header
Path Parameters
uuidRequest Body
application/json
Request Body
Packet capture request payload for organization-level captures
Initiate a Mist Edge Packet Capture
Packet capture duration, in seconds. Default is 600, minimum is 60 and maximum is 10800 (3h)
60 <= value <= 10800600Output format for the Mist Edge packet capture. enum: stream, tzsp.
"stream"Value in
- "stream"
- "tzsp"
Max_len of each packet to capture. Default is 512, minimum is 64 and maximum is 1536
64 <= value <= 1536512Dict of Mist Edges to capture on, property key is the Mist Edge ID. Property value is a dict of interfaces to capture for the given Mist Edge (e.g. port1, kni0, lacp0, ipsec, drop, oobm)
Number of packets to capture. Default is 1024, maximum is 10000, minimum 1, or 0 for unlimited (local/remote streaming only)
0 <= value <= 100001024tcpdump expression, applicable across all interfaces if specified at top level. An interface-specific value (under the interfaces dict) overrides this top-level value.
Packet capture type discriminator for Mist Edge captures. enum: mxedge.
Value in
- "mxedge"
Required if format==tzsp. Remote host accessible to mxedges over the network for receiving the captured packets
Optional port on remote host for receiving the captured packets. Default is 37008 (TZSP)
1 <= value <= 6553537008Response Body
curl -X POST "https://example.com/api/v1/orgs/000000ab-00ab-00ab-00ab-0000000000ab/pcaps/capture" \ -H "Content-Type: application/json" \ -d '{ "duration": 600, "format": "stream", "max_pkt_len": 1500, "mxedges": { "00000000-0000-0000-1000-001122334455": { "interfaces": { "port1": { "tcpdump_expression": "udp port 67 or udp port 68" } } } }, "num_packets": 100, "type": "mxedge" }'{ "ap_count": 3, "aps": [], "duration": 600, "enabled": true, "expiry": 1614886726.5411825, "format": "stream", "id": "a9a84e13-a714-b1eb-152f-a434416217d5", "include_mcast": false, "max_pkt_len": 68, "num_packets": 100, "org_id": "a9346fba-f920-e99a-cc51-2e8dcc57fa3c", "raw": true, "site_id": "67970e46-4e12-11e6-9188-0242ac110007", "ssid": "", "timestamp": 1614886126.5411825, "type": "radiotap"}