5-tuple packet capture enables the FW to copy the passing packets and save or display them in a certain format on the FW.
The 5-tuple in 5-tuple packet capture includes the source IP address, destination IP address, source port, destination port, and protocol. 5-tuple packet capture enables the device to capture the 5-tuple of packets based on the packet capture configuration. Captured data is eventually saved as a user-defined .cap file to the CF card of the device. You can download the file to the PC through FTP/SFTP, use packet capture software to open it, and analyze captured packets. If a device or service fault cannot be located based on the device configuration and traffic statistics, the packet header of a specific flow needs to be captured for analysis. In this case, 5-tuple packet capture applies.
5-tuple packet capture greatly reduces costs and improves the efficiency of fault locating by rapidly capturing and analyzing error or lost packets. Compared with port mirroring, 5-tuple packet capture is much simpler and quicker.