A network engineer adds a virtual Threat Defense appliance to the Management Center, but the device keeps reporting a communication error while production traffic flows normally on its outside interface. Management traffic uses the management0 interface. The engineer wants proof from the device CLI of whether the manager's exchanges reach it, limited to that conversation. Which capture approach should the engineer use?
Select an answer to reveal the explanation.
Short Explanation
Follow the sftunnel: the Management Center and the device talk over TCP 8305 on the management interface. Capture there, filtered to the manager's address and that port, and you see only that conversation.
Full Explanation
Device-to-manager communication uses the sftunnel channel on TCP port 8305, and on this appliance it runs over the management0 interface. The capture-traffic command in the Threat Defense CLI lets the engineer choose the management interface and apply a tcpdump-style filter such as host plus port 8305, which records only the exchanges between the device and the Management Center and shows whether packets arrive, whether the device answers, and whether resets occur. Capturing on the outside data interface looks in the wrong place, because management traffic does not traverse that interface here, so an empty capture would prove nothing. Filtering on TCP 443 targets the manager's web interface, which the device does not use for registration and policy exchanges. An unfiltered capture on the management interface does include the right packets but mixes in unrelated management traffic, failing the requirement to limit the capture to that conversation. Exam caveat: a separate data interface can be configured for manager access, in which case the capture moves to that interface. Practical check: start the capture, trigger a deployment or registration retry, and confirm SYNs and replies on port 8305.