The FMC reports that a device stopped checking in after a network rewrite, and separately users cannot reach 198.51.100.20 on TCP 443 through that device. The engineer must prove whether control-channel packets from the FMC arrive and whether user traffic reaches the data port, keeping both capture files small. Which packet capture plan covers the control path and the data path with the right filters?
Select an answer to reveal the explanation.
Short Explanation
You kept the two planes on their own interfaces, which is the whole trick. Control traffic shows up on the management interface, while user sessions arrive on the data interface, so each capture needs its own home and its own filter, and you'll get a small file you can actually open.
Full Explanation
FTD packet capture applies a filter that behaves like a permit list, so only frames matching the endpoints and ports you name are counted and written, and each capture is bound to one interface. The FMC control channel travels on the management path while user sessions arrive on a data interface, which is why two captures are needed and why each filter must point at the traffic that path actually carries. Swapping the interfaces fails because the control filter then watches a port where FMC packets never appear and the data filter watches a port where user traffic never lands. A single management capture fails because it cannot show whether user packets reach the firewall, leaving half the question unanswered. Two unfiltered captures answer the path question but fail the size requirement, since buffers fill with unrelated traffic and the moment of failure is buried or overwritten. Exam caveat: capture buffers are small and roll over quickly, so start the capture just before reproducing the fault. Practical check: reproduce the problem, confirm the expected filter shows hits, and open the saved file to inspect the first matching frame.