{{tag>Services "Service 12" "PCAP Recording" "Service 17" "VLAN Mirroring"}}
====== PCAP Recording Management and VLAN Mirroring ======
{{indexmenu_n>4}}
===== PCAP Recording Management =====
Service 12 includes PCAP recording for all subscriber traffic. The PCAP file is placed in the path specified in the basic configuration in ''fastdpi.conf'':
<code bash>ajb_udpi_path</code>

<note important>In Service 12, PCAP is recorded at the subscriber level, after the processing, policing, and services have been applied to the subscriber.</note>

When the parameter ''ajb_reserved=1'' is active, you can control the start and stop of the recording on the platform using the SM utility ''fdpi_ctrl'':
<code bash>
fdpi_ctrl setenv --ajb_save_url  1
fdpi_ctrl setenv --ajb_save_udpi 1
</code>

Enabling PCAP recording:
<code bash>
fdpi_ctrl load --service 12 --ip 192.168.1.1
fdpi_ctrl load --service 12 --login USER101 </code>

Disabling:
<code bash>
fdpi_ctrl del --service 12 --ip 192.168.1.1
fdpi_ctrl del --service 12 --login USER101
</code>

To quickly search for data in the PCAP file, you can create a file with indexable data by enabling the setting in ''/etc/dpi/fastdpi.conf'':
<code bash>
ajb_pcap_ind_mask=1
</code>
Where:
  * 0 - index is not created (default)
  * 1 - by IPv4
  * 2 - by IPv6
  * 3 - by IPv4 and IPv6

<note important>If other recording methods for the same subscriber, ''ajb_save_udpi'' or ''ajb_save_ip'', are enabled, the resulting index will not write ''SESSION_ID''</note>
<note>The minimum PCAP file size is 100 MB</note>

===== VLAN Mirroring =====
Service 17 includes mirroring subscriber traffic to a specific VLAN, which is added to the data ports of SSG. The traffic direction is preserved.

Configuration in ''fastdpi.conf'':
<code bash>
span_vlan=123
</code>

For diagnostics, you can use one of the parameters in ''fastdpi.conf'':\\
:!: These are hot parameters, enabled and disabled with ''reload''
<code bash>
trace_ip
span_trace
ajb_save_emit
</code>

Enabling VLAN mirroring:
<code bash>
fdpi_ctrl load --service 17 --ip 192.168.1.1
fdpi_ctrl load --service 17 --login USER101 </code>

Disabling VLAN mirroring:
<code bash>
fdpi_ctrl del --service 17 --ip 192.168.1.1
fdpi_ctrl del --service 17 --login USER101
</code>

<note important>If both services 12 and 17 are enabled, the PCAP will show both the original and mirrored recordings.</note>