Open topic with navigation

Working with Event Payloads

An event payload is the information carried in the body of the event's network packet, as distinct from the packet's header data. From the Console, you can search, retrieve, view, save to a file, or discard event payloads.

The first step in handling event payloads is to be able to locate payload-bearing events among the general flow of events in an active channel.

Events payloads are identified by the Payload ID icon:

To find payloads:

  1. In an active channel, right-click a column header and choose Add Column>Device>Payload ID.

  2. Look for events showing a Payload ID in that column.

To retrieve payloads:

  1. In an active channel, double-click an event with an associated payload.

  2. In the Event Inspector, click the Payload tab.

  3. Click Retrieve Payload.

To preserve payloads:

You can select to preserve the payload for an event in either of two ways:

To discard payloads:

In an active channel, right-click an event with an associated payload and choose Payload, then Discard Preserved.

You can also use the Event Inspector, as follows:

  1. In an active channel, double-click an event with an associated payload.

  2. In the Event Inspector, click the Payload tab.

  3. Click Discard Preserved Payload.

To save payloads to files:

  1. In an active channel, double-click an event with an associated payload.

  2. In the Event Inspector, click the Payload tab.

  3. Click Save Payload.

  4. In the Save dialog box, navigate to a directory and enter a name in the File name text field.

  5. Click Save.

To view payloads in other viewers:

  1. In an active channel, double-click an event with an associated payload.

  2. In the Event Inspector, click the Payload tab.

  3. Click Launch External Payload Viewer.

  4. View the payload using the Preferred Payload Viewer and Text to PCAP Converter, specified in the Console's Edit>Preferences>Programs panel.