Diagnostics — capture#

The Capture tab does not capture packets. It builds the command that does, from an interface picker and a filter box, and prints it for you to run at the console. This page documents that plainly, because the tab used to claim otherwise and the correction is the point.

What the tab shows#

Two panels side by side.

Packet capture — the inputs:

Field	What it offers
Interface	A dropdown of every interface from `GET /api/interfaces/detail`, each labelled with its description or its state.
BPF filter	A free-text field. The hint gives the syntax: "Standard pcap syntax, e.g. 'tcp port 443 and host 10.0.3.1'".

Run on the router — the composed command, updating as you type, with the note underneath:

Not automated yet: the agent does not start captures or return the file. Stop it with Ctrl-C and copy the pcap off with scp.

For eth1 and a filter of tcp port 443, the block reads:

monitor traffic interface eth1 \
  filter 'tcp port 443' \
  save /tmp/capture.pcap

With the filter box empty the command uses ip.

Doing it#

At the console, or over SSH if it is enabled:

monitor traffic interface eth1 filter 'tcp port 443' save /tmp/capture.pcap

Stop it with Ctrl-C. Then, from your workstation:

bash

scp vyos@<router>:/tmp/capture.pcap .
ssh  vyos@<router> 'rm -f /tmp/capture.pcap'

Do not leave a capture running unattended: an unfiltered capture on a busy interface fills /tmp at line rate, and /tmp filling is a router problem, not a disk-space inconvenience.

The endpoint, if you find it#

POST /api/capture exists and is wired into the write plane, but it never starts anything:

bash

curl -sk -X POST -H "Authorization: Bearer $T" -H 'Content-Type: application/json' \
  -d '{"interface":"eth1","filter":"tcp port 443"}' \
  https://<router>:8443/api/capture

json

{
  "error": "packet capture is not implemented in this agent yet",
  "command": "monitor traffic interface eth1 filter 'tcp port 443' save /tmp/capture.pcap"
}

The status is 501 Not Implemented. The interface defaults to eth0 and the filter to ip when either is omitted, and both are quoted the way the CLI accepts them before they are put in the string.