====== Configuring local record PCAP, Clickstream, SIP ======

{{indexmenu_n>2}}

The system allows to record the traffic for selected protocols in PCAP format. It can save also metadata of HTTP requests, SIP, FTP in log files.

​

====== PCAP ======

To start recording IP or CIDR traffic (0.0.0.0/0 - to record all traffic)

<code bash>

ajb_save_ip=192.168.0.0/24

</code>

This is a "hot" parameter, so this list can be changed with the command: **service fastdpi reload**

​

<note important>''ajb_save_ip'' works independently of the subscriber on the input itself and writes all subscriber traffic before services and policing were applied to it.</note>

​

If you set the configuration parameter

<code bash>

ajb_reserved=1

</code>

the memory for the record buffer is allocated in advance (at DPI start) and you can start and stop data recording on the run. You only need to change parameters ajb_save_url, ajb_save_udpi and ajb_save_ip.

​

To record the data in PCAP format: please use the following parameters in configuration file **///etc/dpi/fastdpi.conf//**:

<code bash>

ajb_save_udpi=1

ajb_save_udpi_proto=OSPFIGP:ospf-lite

ajb_udpi_path=/var/dump/dpi

</code>

Here:

  * //ajb_save_udpi=1// - activate the traffic recording for a list of protocols\\

  * //ajb_udpi_path=/var/dump/dpi// - is a directory to place log files (/var/dump/dpi by default)\\