Colasoft Capsa FAQ

Capsa is an expert network analyzer which helps network specialists detect and troubleshoot network problems, improve network performance, and enhance network security.

With the abilities of real time packet capture, accurate protocol decoding and analysis, automatic network events diagnosis, combined powerful filters and statistic information of global network, Capsa quickly and efficiently lets you find what you want in your network.

Network engineers & administrators - monitor network activities and troubleshoot network problems.
Network application developers - troubleshoot and debug network applications.
Teachers and students of network class - demonstrate network protocol structures and network theories.
Parents - monitor children's email, web browsing and instant messenger talks.

The Free Edition is provided to SMB with limited budget for a professional network analyzer to help their network administrators troubleshoot their network, and network training organizations and students to teach and learn network knowledge. Read Compare Editions for details

No. Capsa itself only passively captures network traffic of your selected network adapters and it doesn't send any packets to your network.

Please first figure out on what device you connect the machine with Capsa installed. If it's a HUB, you can see all traffic in that network. If a switch, check out whether its port mirroring powered.

If the switch supports port mirroring, you just need to configure it to copy all traffic to your computer. If the switch doesn't support port mirroring, you may need to invest in a cheap HUB or TAP or switch with port mirroring function.

To troubleshoot network problems, you should have basic knowledge of network protocols and know how the network devices work.

If you just want to use Capsa for simple missions like monitoring network utilization, web browsing, email messages and IM talks, you don't have to go that far into network theory.

Yes. You can learn more details with Technical Specifications.

10-Node-Limit means the Free Edition analyzes traffic of the first 10 captured local IP addresses (broadcast IP addresses and multicast IP addresses are not included) in your network by a default Serial Number. The other local IP addresses captured later on will be grouped into the Exceed Limit Group.

The tabs in the main view will be disabled while any node in Exceed Limit Group selected.

To use Capsa Free, you are required to apply a Serial Number on this page.

It may take a while to deliver the email to your mailbox. If you don't see the email in 15 minutes, please try another email address.

When installing Capsa, if you get errors like "procedure entry point could not be located in the dynamic link library", please try to uninstall Capsa first and then install it again

According to our license policy, one license can only be activated on one machine or one OS. If you want to reinstall Capsa on a new machine or on the same machine which is reinstalled with a new OS, there will be a notice: You have reached your installation limits. You should completely uninstall Capsa previously installed and then install it on a new machine or new OS, or you can just contact us for help.

The error "invalid or corrupt signature" is probably caused by the operating system itself or browser settings.

As a solution, please open the file folder containing the installation package and double-click to install it. If it still doesn't work, please send the MD5 value of the file to support@colasoft.com and we will check if the file is downloaded completely.

Capsa provides a lot of statistics and functions in a single suite. You may get lost in different tabs when you are running a capture. Please tell yourself what problems you have in your network. Then try to focus on one problem at first.

Please read your switch's manual or visit its website to learn how to setup port mirroring. Or you may ask their technicians for help.

Generally, if your adapter supports promiscuous mode it can work well with Capsa. A possible reason is that you didn't connect your machine to the right network device, or misconfigured you switch to see all the traffic on your network. You should read this article to learn how to deploy Capsa.

The Dashboard is visible only when you select the root node in the Node Explorer. That's because the Dashboard is global, which doesn't belong to any specific node in the Node Explorer. When a node selected in the Node Explorer, only the tabs relating to the selected is visible.

You get this error message because you rerun the program too quickly while it is just closed. Therefore, please wait for a while (30 seconds will be enough) to rerun Capsa again after you close it. Or, you can kill the process, named Capsa, in the Task Manager if you need to rerun Capsa immediately.

To create packet buffer, Capsa require a contiguous block of memory. It has nothing to do with your whole RAM value.

You should be careful with packet buffer. It reduces the performance of the software. For an analysis mission, 256MB should contain enough packets for you to find out anomalies. If possible, you are recommended to enable the program to save the captured packets to disk if you really don't want to miss anything.

In order to monitor the traffic for your remote business network, you should install Capsa on a workstation in your business network, and enable the Remote Desktop Access function of that workstation (Windows2000 Terminal Server, TeamViewer, Norton PcAnywhere, VNC Server, etc.), then you can access to Capsa via the local Remote Desktop client program.

You can try, 1, Restart or reinstall the software. 2, Update to the latest version of Capsa. 3. Check if the unidentified NIC is in poor contact. 4, Check the adapter driver. 5, Replace with other NICs.

If the problem is still exist, please send the details to support@colasoft.com for help.

When Capsa captures only part of the traffic, please check following three items:

1. If Capsa is deployed at the right place.

As a network analyzer, Capsa captures the traffic that the monitored network adapter delivers. In other words, if the monitored network adapter is used by a machine for network connection, then Capsa captures the traffic of that machine. If the monitored network adapter is connected to the port mirroring destination port of a managed switch and the destination port gets a copy of the whole network, then Capsa captures the traffic of the whole network. For information on how to deploy Capsa, please refer to http://www.colasoft.com/support/installation.php.

2. If the port mirroring is configured correctly.

If you enable port mirroring function and the cables and network adapters are connected correctly, but you still didn't capture all the traffic, please check if the port mirroring settings are configured without fault. For information on how to configure port mirroring, please refer to http://www.colasoft.com/resources/switch-management.php.

3. If you enable capture filters.

If everything works fine but Capsa still capture part of the traffic, please check if you enable any capture filters. Capture filters will screen out the unmatched packets. If you want to capture all packets, you should not enable any capture filters

Yes. To view the total bandwidth utilization, just go to the Summary view. The column "Utilization" tells the total bandwidth utilization. You can also go to the Dashboard view; the chart "Global - Utilization" shows a trend chart of total bandwidth utilization.

Please note that, to get an accurate utilization, you should set up an actual bandwidth in the Network Profile Settings dialog box.

To know the bandwidth utilization of a single machine, just go to the IP Endpoint view. The column "bps" tells the throughput of that machine. You can get the bandwidth utilization of that machine via dividing the network bandwidth by the "bps" figure.

Yes. To know which websites that an internal IP address visits, just go to the IP Endpoint view, highlight the IP address that you are interested in, then the lower IP Conversation tab shows the websites that the IP address visits.

Please note that, to show the website domain name instead of IP address, you should enable a network profile and show the IP address as name.

Yes. To know which websites that an internal IP address visits, just go to the IP Endpoint view, highlight the IP address that you are interested in, then the lower IP Conversation tab shows the websites that the IP address visits.

Yes, you can use Capsa to replay the packet files saved from Wireshark. The packet files could be .cap, .pcap, and .pcapng formats.

Please check if there is a crash report file under C:\Users\[username]\AppData\Roaming\Colasoft Capsa - Enterprise Edition\CrashReport. You should get it before re-opening Capsa after the crash happens, or the crash report file will disappear. If there is the crash report file, please send it to us for further research.

Yes, Capsa is capable of analyzing VoIP traffic, but currently only the traffic of SIP protocol can be analyzed.

Yes, Capsa supports command lines from v8.1, you can input command lines to run Capsa v8.1 and later versions.

Yes, if Capsa starts capturing packets before the behavior of domain name resolution of DNS server, it will show it in the form of domain name instead of IP address.