Starting or stopping packet capture

You can control the number of recordings your appliance captures.

Before you begin

Verify that the links are up, see Capture port verification.
Verify that PTP is running and locked (if applicable), see Time Sync Verification.

In QRadar® Network Packet Capture, click the ADMIN tab.
Go to the CONTROL widget.
Set Traffic Capture to Turn On or Turn Off.
Check the Remember state check box to retain your settings.
Figure 1. CONTROL widget: Traffic Capture option

By default, packet capture is turned on. If the QRadar Network Packet Capture appliance is not capturing packets, then Traffic Capture is set to Turn On. If the QRadar Network Packet Capture appliance is capturing packets, then Traffic Capture is set to Turn Off.