Mist Utilities PCAPs API
API Calls to start, stop or managed Packet Captures at the device level
OpenAPI Specification
openapi: 3.1.0
info:
contact:
email: tmunzer@juniper.net
name: Thomas Munzer
description: '> Version: **2606.1.1**
>
> Date: **July 10, 2026**
<div class="notification"> NOTE:<br>Some important API changes will be introduced. Please make sure to read the <a href="https://www.juniper.net/documentation/us/en/software/mist/api/http/guides/important-api-changes">announcements</a> </div>
---
## Additional Documentation
* [Mist Automation Guide](https://www.juniper.net/documentation/us/en/software/mist/automation-integration/index.html)
* [Mist Location SDK](https://www.juniper.net/documentation/us/en/software/mist/location-services/topics/concept/mist-how-get-mist-sdk.html)
* [Mist Product Updates](https://www.juniper.net/documentation/us/en/software/mist/product-updates/)
## Helpful Resources
* [API Sandbox and Exercises](https://api-class.mist.com/)
* [Postman Collection, Runners and Webhook Samples](https://www.postman.com/juniper-mist/workspace/mist-systems-s-public-workspace)
* [Python Script Examples](https://github.com/tmunzer/mist_library)
* [API Demo Apps](https://apps.mist-lab.fr/)
* [Juniper Blog](https://blogs.juniper.net/)
## Mist Web Browser Extension:
* Google Chrome, Microsoft Edge and other Chromium-based browser: [Chrome Web Store](https://chromewebstore.google.com/detail/mist-extension/ejhpdcljeamillfhdihkkmoakanpbplh)
* Firefox: [Firefox Add-ons](https://addons.mozilla.org/en-US/firefox/addon/mist-extension/)
---'
license:
name: MIT
url: https://raw.githubusercontent.com/tmunzer/Mist-OAS3.0/main/LICENSE
title: Mist Admins Utilities PCAPs API
version: 2606.1.1
x-logo:
altText: Juniper-MistAI
backgroundColor: '#FFFFFF'
url: https://www.mist.com/wp-content/uploads/logo.png
servers:
- description: Mist Global 01
url: https://api.mist.com
- description: Mist Global 02
url: https://api.gc1.mist.com
- description: Mist Global 03
url: https://api.ac2.mist.com
- description: Mist Global 04
url: https://api.gc2.mist.com
- description: Mist Global 05
url: https://api.gc4.mist.com
- description: Mist EMEA 01
url: https://api.eu.mist.com
- description: Mist EMEA 02
url: https://api.gc3.mist.com
- description: Mist EMEA 03
url: https://api.ac6.mist.com
- description: Mist EMEA 04
url: https://api.gc6.mist.com
- description: Mist APAC 01
url: https://api.ac5.mist.com
- description: Mist APAC 02
url: https://api.gc5.mist.com
- description: Mist APAC 03
url: https://api.gc7.mist.com
security:
- apiToken: []
- csrfToken: []
tags:
- description: API Calls to start, stop or managed Packet Captures at the device level
name: Utilities PCAPs
paths:
/api/v1/orgs/{org_id}/pcaps:
parameters:
- $ref: '#/components/parameters/org_id'
get:
description: List organization packet capture sessions and generated capture files for the selected time range.
operationId: listOrgPacketCaptures
parameters:
- $ref: '#/components/parameters/start'
- $ref: '#/components/parameters/end'
- $ref: '#/components/parameters/duration'
- $ref: '#/components/parameters/limit'
- $ref: '#/components/parameters/page'
responses:
'200':
$ref: '#/components/responses/PcapsSearch'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: listOrgPacketCaptures
tags:
- Utilities PCAPs
/api/v1/orgs/{org_id}/pcaps/capture:
parameters:
- $ref: '#/components/parameters/org_id'
delete:
description: Stop the currently running organization packet capture and end its websocket output stream.
operationId: stopOrgPacketCapture
responses:
'200':
$ref: '#/components/responses/OK'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: stopOrgPacketCapture
tags:
- Utilities PCAPs
get:
description: Retrieve the current organization packet capture status, including active capture targets and progress.
operationId: getOrgCapturingStatus
responses:
'200':
$ref: '#/components/responses/PcapStatus'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: getOrgCapturingStatus
tags:
- Utilities PCAPs
post:
description: "Start an organization-level packet capture for org-level Mist Edges\n\n**NOTE**: For packet captures of org level Mist Edges only. Use [Start Site Packet Capture](/#operations/startSitePacketCapture) for site level Mist Edges. \n\nThe output will be available through websocket. As there can be multiple commands issued against the same AP at the same time and the output all goes through the same websocket stream, session is introduced for demux.\n\n#### Subscribe to Device Command outputs\n`WS /api-ws/v1/stream`\n\n```json\n{\n \"subscribe\": \"/orgs/:org_id/pcaps\"\n}\n```\n#### Response (MxEdge)\n```json\n{\n \"event\": \"data\"\n \"channel\": \"/orgs/67970e46-4e12-11e6-9188-0242ac110007/pcaps\"\n \"data\": {\n \"capture_id\": \"f039b1b4-a23e-48b2-906a-0da40524de73\", \n \"pcap_dict\": {\n \"dst_mac\": \"68:ec:c5:09:2e:87\",\n \"src_mac\": \"8c:3b:ad:e0:47:40\", \n \"vlan\": 1, \n \"src_ip\": \"34.224.147.117\", \n \"dst_ip\": \"192.168.1.55\",\n \"dst_port\": 51635, \n \"src_port\": 443,\n \"protocol\": \"TCP\", \n \"mxedge_id\": \"00000000-0000-0000-1000-001122334455\",\n \"direction\": \"tx\", \n \"timestamp\": 1652247615, \n \"length\": 159.0, \n \"lost_messages\": 0,\n \"interface\": \"port0\",\n \"info\": \"1652247616.007409 IP ec2-34-224-147-117.compute-1.amazonaws.com.https > ip-192-168-1-55.ec2.internal.51635: Flags [P.], seq \\n 2192123968:2192124057, ack 4035166782, win 12, options [nop,nop,TS val 597467050 ecr 740580660], length 89\\\\n\",\n }, \n \"pcap_raw\": \"1MOyoQIABAAAAAAAAAAAAP//AAABAAAAQEx7YhMzAACfAAAAnwAAAGjsxQkuh4w7reBHQIEAAAEIAEUAAI1bLEAAKAZ/CiLgk3XAqAE3AbvJs4KpKEDwg8I+gBgADFf9AAABAQgKI5yfqiwkXTQXAwMAVKY5JopoKQrVEn0/3ld4YntctGEH/rTZuwtCvzSncFw71QJveJi9uxHs57KC8w9Apph3YvXJrmWg7M37+o+YV0KH/xmr626s5Bkhb3QhKOu+NoNEmA==\"\n }\n}\n```\n#### Stop Response\n```json\n{\n \"event\": \"data\"\n \"channel\": \"/orgs/67970e46-4e12-11e6-9188-0242ac110007/pcaps\"\n \"data\": {\n \"capture_id\": \"a2f7374d-6a70-41fd-8a3f-71e42573baaf\",\n \"pcap_dict\": null\n }\n}\n```"
operationId: startOrgPacketCapture
requestBody:
content:
application/json:
examples:
MxEdge-Packet-Capture:
value:
duration: 600
format: stream
max_pkt_len: 1500
mxedges:
00000000-0000-0000-1000-001122334455:
interfaces:
port1:
tcpdump_expression: udp port 67 or udp port 68
num_packets: 100
type: mxedge
schema:
$ref: '#/components/schemas/capture_org'
description: Request Body
responses:
'200':
$ref: '#/components/responses/PcapStart'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: startOrgPacketCapture
tags:
- Utilities PCAPs
/api/v1/sites/{site_id}/pcaps:
parameters:
- $ref: '#/components/parameters/site_id'
get:
description: List packet captures for a site, optionally filtered by client MAC address and time range. Use [List Org Packet Captures](/#operations/listOrgPacketCaptures) to retrieve packet captures across the organization.
operationId: listSitePacketCaptures
parameters:
- description: Optional client mac filter
in: query
name: client_mac
schema:
type: string
- $ref: '#/components/parameters/start'
- $ref: '#/components/parameters/end'
- $ref: '#/components/parameters/duration'
- $ref: '#/components/parameters/limit'
- $ref: '#/components/parameters/page'
responses:
'200':
$ref: '#/components/responses/PcapsSearch'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: listSitePacketCaptures
tags:
- Utilities PCAPs
/api/v1/sites/{site_id}/pcaps/capture:
parameters:
- $ref: '#/components/parameters/site_id'
delete:
description: Stop current capture
operationId: stopSitePacketCapture
responses:
'200':
$ref: '#/components/responses/OK'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: stopSitePacketCapture
tags:
- Utilities PCAPs
get:
description: Get Capturing status
operationId: getSiteCapturingStatus
responses:
'200':
$ref: '#/components/responses/PcapStatus'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: getSiteCapturingStatus
tags:
- Utilities PCAPs
post:
description: "Initiate a Site Packet Capture\n\nThe output will be available through websocket. As there can be multiple commands issued against the same AP at the same time and the output all goes through the same websocket stream, session is introduced for demux.\n\n#### Subscribe to Device Command outputs\n`WS /api-ws/v1/stream`\n\n```json\n{\n \"subscribe\": \"/sites/{site_id}/pcaps\"\n}\n```\n#### Response (MxEdge)\n```json\n{\n \"event\": \"data\"\n \"channel\": \"/sites/{site_id}/pcaps\"\n \"data\": {\n \"capture_id\": \"6b1be4fb-b239-44d9-9d3b-cb1ff3af1721\",\n \"lost_messages\": 0\n \"pcap_dict\": {\n \"channel_frequency\": 2412,\n \"channel\": \"1\",\n \"datarate\": \"1.0 Mbps\",\n \"rssi\": -75, \n \"dst\": \"78:bd:bc:ca:0b:0a\",\n \"src\": \"18:b8:1f:4c:91:c0\",\n \"bssid\": \"18:b8:1f:4c:91:c0\",\n \"frame_type\": \"Management\", \n \"frame_subtype\": \"Probe Response\", \n \"proto\": \"802.11\", \n \"ap_mac\": \"d4:20:b0:81:99:2e\", \n \"direction\": \"tx\", \n \"timestamp\": 1652246543, \n \"length\": 416.0,\n \"interface\": \"radiotap\",\n \"info\": \"1652246544.467733 1683216786us tsft 1.0 Mb/s 2412 MHz 11g -75dBm signal -82dBm noise antenna 0 Probe Response (ATTKmsWiVS) [1.0* 2.0* 5.5* 11.0* 18.0 24.0 36.0 54.0 Mbit] CH: 2, PRIVACY\\\\n\",\n }, \n \"pcap_raw\": \"1MOyoQIABAAAAAAAAAAAAP//AAABAAAAEEh7Yh5VBwCgAQAAoAEAAAAAKwBvCADAAQAAAIw7reCS2VNkAAAAABACbAmABLWuAAEAEBgAAwACAABQADoBeL28ygsKGLgfTJHAGLgfTJHAcIZ2WDlBJQAAAGQAERUACkFUVEttc1dpVlMBCIKEi5YkMEhsAwECBwZVUyABCx4gAQAjAhkAKgEEMgQMEhhgMBQBAAAPrAQBAAAPrAQBAAAPrAIMAAsFAQAbAABGBTIIAQAALRqtCR////8AAAAAAAAAAAAAAAAAAAAAAAAAAD0WAggVAAAAAAAAAAAAAAAAAAAAAAAAAH8IBAAIAAAAAEDdkwBQ8gQQSgABEBBEAAECEDsAAQMQRwAQn2481frn3KT+uGod2ERx+RAhAAtBcnJpcywgSW5jLhAjAApCR1cyMTAtNzAwECQACkJHVzIxMC03MDAQQgAKQkdXMjEwLTcwMBBUAAgABgBQ8gQAARARAA5BcnJpcyBXaXJlbGVzcxAIAAIgCBA8AAEBEEkABgA3KgABIN0JABAYAgEQHAAA3RgAUPICAQGEAAOkAAAnpAAAQkNeAGIyLwAzjakr\"\n}\n```\n\n#### Response (Wired)\n```json\n{\n \"event\": \"data\"\n \"channel\": \"/sites/67970e46-4e12-11e6-9188-0242ac110007/pcaps\"\n \"data\": {\n \"capture_id\": \"f039b1b4-a23e-48b2-906a-0da40524de73\", \n \"pcap_dict\": {\n \"dst_mac\": \"68:ec:c5:09:2e:87\",\n \"src_mac\": \"8c:3b:ad:e0:47:40\", \n \"vlan\": 1, \n \"src_ip\": \"34.224.147.117\", \n \"dst_ip\": \"192.168.1.55\",\n \"dst_port\": 51635, \n \"src_port\": 443,\n \"proto\": \"TCP\", \n \"ap_mac\": \"d4:20:b0:81:99:2e\",\n \"direction\": \"tx\", \n \"timestamp\": 1652247615, \n \"length\": 159.0, \n \"interface\": \"wired\",\n \"info\": \"1652247616.007409 IP ec2-34-224-147-117.compute-1.amazonaws.com.https > ip-192-168-1-55.ec2.internal.51635: Flags [P.], seq 2192123968:2192124057, ack 4035166782, win 12, options [nop,nop,TS val 597467050 ecr 740580660], length 89\\\\n\",\n }, \n \"pcap_raw\": \"1MOyoQIABAAAAAAAAAAAAP//AAABAAAAQEx7YhMzAACfAAAAnwAAAGjsxQkuh4w7reBHQIEAAAEIAEUAAI1bLEAAKAZ/CiLgk3XAqAE3AbvJs4KpKEDwg8I+gBgADFf9AAABAQgKI5yfqiwkXTQXAwMAVKY5JopoKQrVEn0/3ld4YntctGEH/rTZuwtCvzSncFw71QJveJi9uxHs57KC8w9Apph3YvXJrmWg7M37+o+YV0KH/xmr626s5Bkhb3QhKOu+NoNEmA==\"\n\n }\n}\n```\n\n#### Stop Response (Wired/Wireless)\n```json\n{\n \"event\": \"data\"\n \"channel\": \"/sites/67970e46-4e12-11e6-9188-0242ac110007/pcaps\"\n \"data\": {\n \"capture_id\": \"a2f7374d-6a70-41fd-8a3f-71e42573baaf\", \n \"lost_messages\": 0,\n \"pcap_dict\": null\n }\n}\n```"
operationId: startSitePacketCapture
requestBody:
content:
application/json:
examples:
AP-New-Wireless-Client-Associations-Packet-Capture:
value:
client_mac: 60a10a773412
duration: 600
includes_mcast: false
max_pkt_len: 128
num_packets: 100
type: new_assoc
AP-Radiotap-Packet-Capture:
value:
duration: 600
max_pkt_len: 68
num_packets: 100
type: radiotap
AP-Radiotap-Packet-Capture-and-Wired-Packet-Capture:
value:
ap_mac: string
client_mac: 38f9d3972ff1
duration: 600
max_pkt_len: 128
num_packets: 1024
ssid: string
type: radiotap,wired
AP-Scan-radio-Packet-Capture:
value:
ap_mac: null
band: '24'
bandwidth: 20
channel: 1
client_mac: 38f9d3972ff1
duration: 600
format: stream
max_pkt_len: 68
num_packets: 100
tcpdump_expression: tcp port 80
type: scan
AP-Wired-Packet-Capture:
value:
duration: 600
max_pkt_len: 68
num_packets: 100
tcpdump_expression: tcp port 80
type: wired
AP-Wireless-Packet-Capture:
value:
ap_mac: null
band: '24'
duration: 600
max_pkt_len: 128
num_packets: 100
type: wireless
Client-Packet-Capture:
value:
client_mac: 60a10a773412
duration: 300
includes_mcast: false
max_pkt_len: 128
num_packets: 1000
type: client
SSR-Packet-Capture:
value:
duration: 600
format: stream
gateways:
'001122334455':
ports:
ge-0/0/0:
tcpdump_expression: tcp
ge-0/0/1:
tcpdump_expression: port 443
ge-1/0/0:
tcpdump_expression: tcp
ge-1/0/1:
tcpdump_expression: port 443
'001122334466':
ports:
ge-0/0/0:
tcpdump_expression: udp
ge-0/0/1:
tcpdump_expression: port 32768
max_pkt_len: 1500
num_packets: 100
type: gateway
Switch-Packet-Capture:
value:
duration: 600
format: stream
max_pkt_len: 1500
num_packets: 100
switches:
'001122334455':
ports:
ge-0/0/0:
tcpdump_expression: udp
ge-0/0/1: {}
ge-1/0/0: {}
ge-1/0/1: {}
'001122334466':
ports:
ge-0/0/0: {}
ge-0/0/1: {}
tcpdump_expression: port 443
type: switch
schema:
$ref: '#/components/schemas/capture_site'
description: Request Body
responses:
'200':
$ref: '#/components/responses/PcapStart'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: startSitePacketCapture
tags:
- Utilities PCAPs
/api/v1/sites/{site_id}/pcaps/{pcap_id}:
parameters:
- $ref: '#/components/parameters/site_id'
- $ref: '#/components/parameters/pcap_id'
put:
description: Update or add notes to a completed packet capture
operationId: updateSitePacketCapture
requestBody:
content:
application/json:
examples:
Example:
value:
notes: wired pcap test
schema:
$ref: '#/components/schemas/notes_string'
responses:
'200':
$ref: '#/components/responses/OK'
'400':
$ref: '#/components/responses/HTTP400'
'401':
$ref: '#/components/responses/HTTP401'
'403':
$ref: '#/components/responses/HTTP403'
'404':
$ref: '#/components/responses/HTTP404'
'429':
$ref: '#/components/responses/HTTP429'
summary: updateSitePacketCapture
tags:
- Utilities PCAPs
components:
schemas:
capture_radiotapwired_band:
default: '24'
description: 'only used for radiotap. enum: `24`, `24,5,6`, `5`, `6`'
enum:
- '24'
- 24,5,6
- '5'
- '6'
examples:
- '24'
type: string
capture_scan_aps:
additionalProperties: false
description: Property key is the AP MAC address (e.g. "5c5b35000001"). All optionals, parent parameters will be used if not defined
properties:
band:
$ref: '#/components/schemas/capture_scan_aps_band'
description: Radio band on which to start the scan capture
channel:
description: Specify the channel value where scan PCAP has to be started
type: string
tcpdump_expression:
description: tcpdump expression, port specific if specified under ports dict, otherwise applicable across ports if specified at top level of payload. Port specific value overrides top level value when both exist.
type: string
width:
description: Specify the bandwidth value with respect to the channel.
type: string
type: object
timestamp:
description: Epoch timestamp, in seconds
format: double
readOnly: true
type: number
response_pcap_status:
additionalProperties: false
description: Current status of a packet capture session
properties:
ap_mac:
description: AP MAC address targeted by the packet capture, or null when no single AP filter is set
type:
- string
- 'null'
aps:
$ref: '#/components/schemas/response_pcap_status_aps'
description: AP MAC addresses targeted by the packet capture
client_mac:
description: Client MAC address filter applied to the packet capture, or null when no client filter is used
examples:
- 60a10a773412
type:
- string
- 'null'
duration:
description: Configured packet capture duration, in seconds
examples:
- 300
type: integer
enabled:
description: Whether the packet capture session is currently enabled
type: boolean
expiry:
description: Epoch timestamp, in seconds, when the capture session expires
examples:
- 1695838060.309526
type: number
failed:
$ref: '#/components/schemas/response_pcap_status_failed'
description: AP MAC addresses where capture configuration failed
format:
$ref: '#/components/schemas/capture_mxedge_format'
description: Output format for packet capture data
gateways:
$ref: '#/components/schemas/response_pcap_status_gateways'
description: Gateway devices included in the packet capture session
id:
$ref: '#/components/schemas/id'
description: Unique identifier for the packet capture session
includes_mcast:
description: Whether multicast traffic is included in the packet capture
type: boolean
invalid_mxedges:
additionalProperties: true
description: Map of Mist Edge IDs that could not be configured for capture
type: object
max_num_packets:
description: Max number of packets configured by user
examples:
- 1000
type: integer
max_pkt_len:
description: Maximum number of bytes captured from each packet
examples:
- 512
type: integer
mxedge_count:
description: Number of Mist Edges in the capture session
type: integer
mxedges:
$ref: '#/components/schemas/response_pcap_status_mxedges'
description: Mist Edge capture settings keyed by Mist Edge ID
num_packets:
description: total number of packets captured by all AP, not applicable for type [client, new_assoc]
type: integer
ok:
$ref: '#/components/schemas/response_pcap_status_ok'
description: AP MAC addresses successfully configured for packet capture
org_id:
$ref: '#/components/schemas/org_id'
description: Organization associated with the packet capture session
pcap_aps:
$ref: '#/components/schemas/response_pcap_status_pcap_aps'
description: Per-AP radio capture settings keyed by AP MAC address
radiotap_tcpdump_expression:
description: When `type`==`radiotap`, radiotap_tcpdump_expression expression provided by the user
type: string
raw:
description: Whether raw packet data is included in the capture output
type: boolean
scan_tcpdump_expression:
description: When `type`==`scan`, scan_tcpdump_expression provided by the user
type: string
site_id:
$ref: '#/components/schemas/site_id'
description: Site associated with the packet capture session, when site-scoped
ssid:
description: Wireless network SSID filter applied to the packet capture, or null when no SSID filter is used
type:
- string
- 'null'
started_time:
description: Epoch timestamp, in seconds, when the capture session started
examples:
- 1435080709
type: integer
switches:
$ref: '#/components/schemas/response_pcap_status_switches'
description: Switch devices included in the packet capture session
tcpdump_expression:
description: tcpdump expression provided by the user (common)
type: string
timestamp:
$ref: '#/components/schemas/timestamp'
description: Epoch timestamp, in seconds, when the packet capture status was reported
type:
$ref: '#/components/schemas/pcap_type'
description: Packet capture type for the current session
tzsp_host:
description: Required if `format`==`tzsp`. Remote host accessible to Mist Edges over the network for receiving the captured packets.
examples:
- 192.168.1.2
type: string
tzsp_port:
description: If `format`==`tzsp`. Port on remote host for receiving the captured packets
maximum: 65535
minimum: 1
type: integer
wired_tcpdump_expression:
description: When `type`==`wired`, wired_tcpdump_expression provided by the user
type: string
wireless_tcpdump_expression:
description: When `type`==`‘wireless’`, wireless_tcpdump_expression provided by the user
type: string
required:
- id
- type
type: object
capture_switch_ports_tcpdump_expression:
additionalProperties: false
description: Per-port tcpdump filter for a switch packet capture
properties:
tcpdump_expression:
description: tcpdump expression, port specific if specified under ports dict, otherwise applicable across ports if specified at top level of payload. Port specific value overrides top level value when both exist.
examples:
- port 443
type: string
type: object
id:
description: Unique ID of the object instance in the Mist Organization
examples:
- 53f10664-3ce8-4c27-b382-0ef66432349f
format: uuid
readOnly: true
type: string
capture_new_assoc:
additionalProperties: false
description: Initiate a packet Capture for New Wireless Client Associations
properties:
ap_mac:
description: AP MAC address used to target new association capture
examples:
- a83a79a947ee
type: string
client_mac:
description: Client MAC address, required if `type`==`client`; optional otherwise
examples:
- 60a10a773412
type: string
duration:
$ref: '#/components/schemas/capture_duration'
description: Packet capture duration, in seconds
includes_mcast:
default: false
description: Whether to include multicast traffic in the packet capture
type: boolean
max_pkt_len:
$ref: '#/components/schemas/capture_max_pkt_length'
description: Maximum number of bytes captured from each packet
num_packets:
$ref: '#/components/schemas/capture_num_packets'
description: Maximum number of packets to capture; use 0 for unlimited
ssid:
description: Optional SSID filter for new association capture
examples:
- null
type: string
type:
$ref: '#/components/schemas/capture_new_assoc_type'
description: Packet capture type discriminator for new association captures
required:
- type
type: object
capture_switch_format:
default: stream
description: 'Output format for the switch packet capture. enum: `stream`'
enum:
- stream
type: string
capture_mxedge:
additionalProperties: false
description: Initiate a Mist Edge Packet Capture
properties:
duration:
default: 600
description: Packet capture duration, in seconds. Default is 600, minimum is 60 and maximum is 10800 (3h)
examples:
- 600
maximum: 10800
minimum: 60
type: integer
format:
$ref: '#/components/schemas/capture_mxedge_format'
description: Output format for the Mist Edge packet capture
max_pkt_len:
default: 512
description: Max_len of each packet to capture. Default is 512, minimum is 64 and maximum is 2048
examples:
- 512
maximum: 2048
minimum: 64
type: integer
mxedges:
additionalProperties:
$ref: '#/components/schemas/capture_mxedge_mxedges'
description: Dict of Mist Edges to capture on, property key is the Mist Edge ID. Property value is a dict of interfaces to capture for the given Mist Edge (e.g. port1, kni0, lacp0, ipsec, drop, oobm)
type: object
num_packets:
default: 1024
description: Number of packets to capture. Default is 1024, maximum is 10000, minimum 1, or 0 for unlimited (local/remote streaming only)
examples:
- 100
maximum: 10000
minimum: 0
type: integer
tcpdump_expression:
description: tcpdump expression, applicable across all interfaces if specified at top level. An interface-specific value (under the `interfaces` dict) overrides this top-level value.
type: string
type:
$ref: '#/components/schemas/capture_mxedge_type'
description: Packet capture type discriminator for Mist Edge captures
tzsp_host:
description: Required if `format`==`tzsp`. Remote host accessible to mxedges over the network for receiving the captured packets
examples:
- 192.168.1.2
type: string
tzsp_port:
default: 37008
description: Optional port on remote host for receiving the captured packets. Default is 37008 (TZSP)
maximum: 65535
minimum: 1
type: integer
required:
- type
type: object
capture_client:
additionalProperties: false
description: Initiate a Client Packet Capture
properties:
ap_mac:
description: AP MAC address used to target the client packet capture
examples:
- null
type:
- string
- 'null'
client_mac:
description: Client MAC address, required if `type`==`client`; optional otherwise
examples:
- 60a10a773412
type:
- string
- 'null'
duration:
$ref: '#/components/schemas/capture_duration'
description: Packet capture duration, in seconds
includes_mcast:
default: false
description: Whether to include multicast traffic in the packet capture
type: boolean
max_pkt_len:
$ref: '#/components/schemas/capture_max_pkt_length'
description: Maximum number of bytes captured from each packet
num_packets:
$ref: '#/components/schemas/capture_num_packets'
des
# --- truncated at 32 KB (75 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/mist/refs/heads/main/openapi/mist-utilities-pcaps-api-openapi.yml