PCAP Recording Management

PCAP Recording Management

12 Service enables PCAP recording for all subscriber traffic. PCAP files are stored in the directory specified by the ajb_udpi_path parameter in the fastdpi.conf file:

ajb_udpi_path

In 12 Service, PCAP recording is performed at the subscriber level after traffic processing is completed, when policing and services have already been applied to the subscriber.

When the ajb_reserved=1 parameter is enabled, PCAP recording on the platform can be started and stopped using the fdpi_ctrl utility for SM.

fdpi_ctrl setenv --ajb_save_url  1
fdpi_ctrl setenv --ajb_save_udpi 1

Enable recording:

fdpi_ctrl load --service 12 --ip 192.168.1.1
fdpi_ctrl load --service 12 --login USER101

Disable recording:

fdpi_ctrl del --service 12 --ip 192.168.1.1
fdpi_ctrl del --service 12 --login USER101

Recording PCAP from a network port

To record traffic directly from a network port, use the following command:

fdpi_cli dev pcap <dev-name> rx|tx|any|off

Where:

rx — record packets received by the port.
tx — record packets transmitted through the port.
any — record both incoming and outgoing traffic.
off — stop recording.

The generated PCAP files use the following prefixes:

rx-<dev-name> — incoming traffic.
tx-<dev-name> — outgoing traffic.

PCAP indexing

To speed up data searches in PCAP files, you can enable index file generation by setting the ajb_pcap_ind_mask parameter in the /etc/dpi/fastdpi.conf file:

ajb_pcap_ind_mask=1

Possible values:

0 — index is not generated (default).
1 — index IPv4 packets.
2 — index IPv6 packets.
3 — index both IPv4 and IPv6 packets.

If other recording methods are enabled for the same subscriber (ajb_save_udpi or ajb_save_ip), the SESSION_ID field is not written to the index file.

The minimum PCAP file size is 100 MB.

PCAP by IP and CIDR

To start recording IP or CIDR traffic (0.0.0.0/0 - to record all traffic)

ajb_save_ip=192.168.0.0/24

This is a "hot" parameter, so this list can be changed with the command: service fastdpi reload

ajb_save_ip works independently of the subscriber on the input itself and writes all subscriber traffic before services and policing were applied to it.

If you set the configuration parameter

ajb_reserved=1

the memory for the record buffer is allocated in advance (at DPI start) and you can start and stop data recording on the run. You only need to change parameters ajb_save_url, ajb_save_udpi and ajb_save_ip.

To record the data in PCAP format: please use the following parameters in configuration file /etc/dpi/fastdpi.conf:

ajb_save_udpi=1
ajb_save_udpi_proto=OSPFIGP:ospf-lite
ajb_udpi_path=/var/dump/dpi

Here:

ajb_save_udpi=1 - activate the traffic recording for a list of protocols
ajb_udpi_path=/var/dump/dpi - is a directory to place log files (/var/dump/dpi by default)
ajb_save_udpi_proto=OSPFIGP:ospf-lite - is a list of protocols to record as test or numerical identificators. This is a hot parameter. It can be changed on the run by command service fastdpi reload.

You can also activate service 12 (traffic recording) individually for each subscriber.

PCAP files index mask

0 - not created
1 - via IPv4
2 - via IPv6
3 - via both IPv4 and IPv6.

ajb_pcap_ind_mask=0 // not created
ajb_pcap_ind_mask=1 // via IPv4
ajb_pcap_ind_mask=2 // via IPv6
ajb_pcap_ind_mask=3 // via both IPv4 and IPv6

This is a hot parameter. It can be changed on the run by command service fastdpi reload.

PCAP by VLAN

PCAP recording by VLAN is controlled by the parameter:

ajb_save_vlan