The Network IPS appliance uses rolling packet capture, along with the log evidence feature, to gather evidence about suspicious events.
The rolling packet capture feature captures events according to a specified interface. Configure this feature in . You can define how many rolling packet capture files the appliance stores and the size of the files. Also, configure the interface from where the appliance captures packets and the packet capture file format.