{{tag>Services "Service 12" "PCAP Recording"}}
====== PCAP Recording Management ======
{{indexmenu_n>16}}

12 Service enables PCAP recording for all subscriber traffic. PCAP files are stored in the directory specified by the ''ajb_udpi_path'' parameter in the ''fastdpi.conf'' file:
<code bash>
ajb_udpi_path
</code>

<note important>In 12 Service, PCAP recording is performed at the subscriber level after traffic processing is completed, when policing and services have already been applied to the subscriber.</note>

When the ''ajb_reserved=1'' parameter is enabled, PCAP recording on the platform can be started and stopped using the ''fdpi_ctrl'' utility for SM.

<code bash>
fdpi_ctrl setenv --ajb_save_url  1
fdpi_ctrl setenv --ajb_save_udpi 1
</code>

Enable recording:
<code bash>
fdpi_ctrl load --service 12 --ip 192.168.1.1
fdpi_ctrl load --service 12 --login USER101
</code>

Disable recording:
<code bash>
fdpi_ctrl del --service 12 --ip 192.168.1.1
fdpi_ctrl del --service 12 --login USER101
</code>

==== Recording PCAP from a network port ====

To record traffic directly from a network port, use the following command:
<code bash>
fdpi_cli dev pcap <dev-name> rx|tx|any|off
</code>

Where:
  * ''rx'' — record packets received by the port.
  * ''tx'' — record packets transmitted through the port.
  * ''any'' — record both incoming and outgoing traffic.
  * ''off'' — stop recording.

The generated PCAP files use the following prefixes:
  * ''rx-<dev-name>'' — incoming traffic.
  * ''tx-<dev-name>'' — outgoing traffic.

==== PCAP indexing ====

To speed up data searches in PCAP files, you can enable index file generation by setting the ''ajb_pcap_ind_mask'' parameter in the ''/etc/dpi/fastdpi.conf'' file:
<code bash>
ajb_pcap_ind_mask=1
</code>

Possible values:
  * 0 — index is not generated (default).
  * 1 — index IPv4 packets.
  * 2 — index IPv6 packets.
  * 3 — index both IPv4 and IPv6 packets.

<note important>If other recording methods are enabled for the same subscriber (''[[en:dpi:dpi_components:platform:li_ctrl&do=#pcap_by_ip_and_cidr|ajb_save_udpi]]'' or ''[[en:dpi:dpi_components:platform:li_ctrl&do=#pcap_by_ip_and_cidr|ajb_save_ip]]''), the ''SESSION_ID'' field is not written to the index file.</note>

<note>The minimum PCAP file size is 100 MB.</note>
====PCAP by IP and CIDR====
To start recording IP or CIDR traffic (0.0.0.0/0 - to record all traffic)
<code bash>
ajb_save_ip=192.168.0.0/24
</code>
This is a "hot" parameter, so this list can be changed with the command: **service fastdpi reload**

<note important>''ajb_save_ip'' works independently of the subscriber on the input itself and writes all subscriber traffic before services and policing were applied to it.</note>

If you set the configuration parameter
<code bash>
ajb_reserved=1
</code>
the memory for the record buffer is allocated in advance (at DPI start) and you can start and stop data recording on the run. You only need to change parameters ajb_save_url, ajb_save_udpi and ajb_save_ip.

To record the data in PCAP format: please use the following parameters in configuration file **///etc/dpi/fastdpi.conf//**:
<code bash>
ajb_save_udpi=1
ajb_save_udpi_proto=OSPFIGP:ospf-lite
ajb_udpi_path=/var/dump/dpi
</code>
Here:
  * //ajb_save_udpi=1// - activate the traffic recording for a list of protocols\\
  * //ajb_udpi_path=/var/dump/dpi// - is a directory to place log files (/var/dump/dpi by default)\\
  * //ajb_save_udpi_proto=OSPFIGP:ospf-lite// - is a list of protocols to record [[en:dpi:dpi_options:opt_statistics:statistics_info|as test or numerical identificators]]. This is a hot parameter. It can be changed on the run by command **service fastdpi reload**.\\

<note important>You can also activate service 12 (traffic recording) [[en:dpi:dpi_components:platform:li_ctrl|individually for each subscriber]].</note>

PCAP files index mask
  * 0 - not created
  * 1 - via IPv4
  * 2 - via IPv6
  * 3 - via both IPv4 and IPv6.

<code bash>
ajb_pcap_ind_mask=0 // not created
ajb_pcap_ind_mask=1 // via IPv4
ajb_pcap_ind_mask=2 // via IPv6
ajb_pcap_ind_mask=3 // via both IPv4 and IPv6
</code>

This is a hot parameter. It can be changed on the run by command **service fastdpi reload**.

====PCAP by VLAN====

PCAP recording by VLAN is controlled by the parameter:
<code bash>ajb_save_vlan</code>
Possible values:
  * ''n'' — record to PCAP only with the condition ''vlan-id == n'' (qinq will not be recorded, even if ''svlan-id == n'')
  * ''n.m'' — record to PCAP only if ''svlan-id == n'', ''cvlan-id == m''
  * ''n.0'' — record to PCAP if ''svlan-id == n'', ''cvlan-id == any''
Only one active selection rule for recording is supported.\\
Rotation is performed under general conditions (similar to ''ajb_save_ip'').