UtilitiesPCAPs
startSiteFlowCapture
Start a flow capture session on one or more online switches running JMA firmware. The same filter is applied to every switch. Only one packet or flow capture session can be active per site at a time.
The captured flow records are streamed over websocket rather than returned in the HTTP response.
Subscribe to Flow Capture outputs
WS /api-ws/v1/stream
Authorization<token>
Preferred authentication method for automation and integrations. Send the API token in the HTTP Authorization header.
Format:
Authorization: Token {apitoken}
Notes:
- An API token generated for a specific admin has the same privileges as that admin
- An API token is automatically removed if it is not used for more than 90 days
- SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed.
In: header
Path Parameters
site_id*string
Format
uuidRequest Body
application/json
Request Body
Flow capture request for one or more switches
dst_ip?string
dst_port?integer
Range
1 <= value <= 65535duration?integer
Range
60 <= value <= 900Default
600protocol?flow_capture_protocol
Flow capture protocol filter. enum: tcp, udp, icmp, icmp6
Value in
- "tcp"
- "udp"
- "icmp"
- "icmp6"
src_ip?string
src_port?integer
Range
1 <= value <= 65535switches*array<string>
Items
1 <= itemsResponse Body
curl -X POST "https://example.com/api/v1/sites/000000ab-00ab-00ab-00ab-0000000000ab/flow_capture" \ -H "Content-Type: application/json" \ -d '{ "dst_ip": "8.8.8.8", "dst_port": 443, "duration": 600, "protocol": "tcp", "src_ip": "10.0.0.0/8", "src_port": 1024, "switches": [ "5c5b35000001", "5c5b35000002" ] }'{ "capture_filter": { "dst_ip": "string", "dst_port": 0, "protocol": "tcp", "src_ip": "string", "src_port": 0 }, "duration": 0, "enabled": true, "expiry": 0, "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "invalid_switches": {}, "org_id": "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61", "site_id": "441a1214-6928-442a-8e92-e1d34b8ec6a6", "switch_count": 0, "timestamp": 0}