# Capture Axis retransmission evidence before its buffers overwrite it > Axis network diagnostics retains a bounded retransmission history. Capture its sampling context and spike data promptly instead of assuming the device keeps an unlimited incident record. - Canonical URL: https://update.dsesecurity.com/updates/capture-axis-retransmission-evidence-before-its-buffers-overwrite-it/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-29T00:10:29+00:00 - Modified: 2026-10-29T00:10:34+00:00 - Last reviewed by DSE: 2026-10-28 - Resource type: Guide - DSE priority: Advisory - Topics: Networks & Infrastructure, Video Surveillance - Reading time: 3 minutes ## What you need to know Axis network diagnostics retains a bounded retransmission history. Capture its sampling context and spike data promptly instead of assuming the device keeps an unlimited incident record. ## Potentially affected Axis devices exposing the documented Network diagnostics API interface; confirm support and the installed API/software scope before applying the proposed checks. ## DSE recommendation DSE recommends adding prompt, read-only diagnostic collection to the first response for an intermittent camera network incident. ## Article Bottom line: Collect the camera’s retransmission evidence while it remains available, and preserve the query interval alongside the result. ## Source fact: documented behavior The [Network diagnostics API](https://developer.axis.com/vapix/device-configuration/network-diagnostics/) documentation says the device buffers a limited number of retransmission samples and overwrites older data after a few days. Its spike history stores up to 1,024 spikes and replaces the oldest entries when that limit is reached. The documented sampling-interval property reports the interval at which retransmissions are sampled. ## What the source does not establish Do not interpret a small retrieved history as proof that an older incident had no network symptoms. Keep the saved evidence bounded to the device, query time and requested history. Avoid treating a retransmission count as a complete explanation of a recording gap, and do not attribute fault to a switch, recorder or carrier without corroborating evidence. ## Applicability questions - When did the suspected recording or connection problem occur? - Which device and requested history window cover that time? - What sampling interval was reported during collection? - Who can correlate the device record with recorder and network observations before the buffered data changes? ## DSE recommendation: controlled next steps The following steps are DSE recommendations based on the cited source. DSE recommends adding prompt, read-only diagnostic collection to the first response for an intermittent camera network incident. - Agree an incident collection order before the next outage. Put the affected device identity, reported event time and time-zone context at the top of the worksheet. Assign one person to preserve the camera evidence while another gathers recorder or network records. Use the supported interface and authorized access for the installed product; do not enable an unfamiliar write operation during evidence collection. - Prepare a proposed pilot in which the investigator collects the reported sampling interval, the requested-hour retransmission information and available spike history. Save the original sanitized responses before producing a chart or summary. Record exactly when the collection began and ended. Keep a zero-result response as evidence too, with its query context, rather than replacing it with an assumed description of the earlier incident. - Compare the saved device observations with the reported loss of usable video. Separate a coincident spike from a proven cause. Ask the network and recording owners to review disagreement between their timelines, and choose the next measurement from that disagreement. If the relevant history is no longer available, record the evidence gap and improve collection timing instead of reconstructing counts from memory. ## Verification and evidence Retain the device and software identity, query settings, sampling interval, capture timestamps and original response files. Preserve any transformed report separately so a reviewer can trace a plotted point back to its source. Sanitize addresses and operational identifiers before sharing outside the investigation team. For the proposed acceptance exercise, rehearse the collection during an approved noncritical test and measure how long the team takes to preserve the data. Define the escalation when nobody can collect promptly. Review the runbook after a real incident or a diagnostic-interface change; this article reports no observed network test or failure cause. ## Official references - [Network diagnostics API](https://developer.axis.com/vapix/device-configuration/network-diagnostics/) — Axis Communications; official VAPIX documentation. Source review completed October 28, 2026. Recheck the official documentation and the deployed device’s capabilities before changing production settings. ## Primary reference - Name: Axis Communications — Network diagnostics API - Authority: Axis Communications - URL: https://developer.axis.com/vapix/device-configuration/network-diagnostics/ - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Capture Axis retransmission evidence before its buffers overwrite it,” DSE Security, https://update.dsesecurity.com/updates/capture-axis-retransmission-evidence-before-its-buffers-overwrite-it/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.