MS250 pcap download issue

[TinOmen]

When taking a PCAP, I'll have the default 60 seconds for the length and wish to download to open in Wireshark.  Most of the time, these pcap's download to my pc with seconds while the web interface says it's still in process, and the pcap file is not modified after that so instead of 60 seconds captured, it's just a few seconds.

Anyone else experiencing this, and is there a setting or config I'm missing somewhere to take proper captures?  Anyone try the CloudShark integration, and does that work with better results than the download option?

[FabianSchleef]

Hi,

which browser are you using? Try downloading a pcap file with incognito mode enabled to make sure your cookies & stuff aren‘t the issue.

[PhilipDAth]

I have had this happen from time to time.  Typically I do nothing and it starts working correctly the next day.  Sometimes a Meraki device reboot helps.

Sometimes when you see the capture has started downloading, the download does not finish till after the minute is up.  I wonder if some devices stream the capture.

[JacekJ]

I also noticed that if a switch has higher loads, some of the traffic will be lost, the packet captures are often unreliable.

[BlakeRichardson]

I have never had that issue and I use packet capture a lot. I am accessing the dashboard via a Mac using Safari.

For me usually a file starts downloading seconds after pressing start, even if i set the duration for 60 seconds and I stop it early I've never had the problem with an empty file.

[TinOmen · Accepted solution]

Thanks everyone.  From your responses, I looked into my browser and I have Malwarebytes Browser Guard turned on it it was filtering stuff from the Meraki dashboard.  Turned off protection for the dashboard site and it worked exactly as you would expect with streaming new data into the save file.

It's a great extension, but completely forgot about it running.

[BlakeRichardson]

@TinOmen  Thanks for pointing that out, we use MalwareBytes but the end point protection version which is cloud managed so I'm going to note about this in case we end up deploying browser protection. 

[TinOmen]

no problem!

[RaphaelL]

Also be aware that the packet capture tool has a lot ( a lot ) of limitation. 

60s without trafic will cancel your capture

3600s MAX OR 100K packets

[TinOmen]

that is great information, thank you, sir