PCAP Recording Management and VLAN Mirroring

PCAP Recording Management

Service 12 includes PCAP recording for all subscriber traffic. The PCAP file is placed in the path specified in the basic configuration in fastdpi.conf:

ajb_udpi_path

In Service 12, PCAP is recorded at the subscriber level, after the processing, policing, and services have been applied to the subscriber.

When the parameter ajb_reserved=1 is active, you can control the start and stop of the recording on the platform using the SM utility fdpi_ctrl:

fdpi_ctrl setenv --ajb_save_url  1
fdpi_ctrl setenv --ajb_save_udpi 1

Enabling PCAP recording:

fdpi_ctrl load --service 12 --ip 192.168.1.1
fdpi_ctrl load --service 12 --login USER101

Disabling:

fdpi_ctrl del --service 12 --ip 192.168.1.1
fdpi_ctrl del --service 12 --login USER101

To quickly search for data in the PCAP file, you can create a file with indexable data by enabling the setting in /etc/dpi/fastdpi.conf:

ajb_pcap_ind_mask=1

Where:

0 - index is not created (default)
1 - by IPv4
2 - by IPv6
3 - by IPv4 and IPv6

If other recording methods for the same subscriber, ajb_save_udpi or ajb_save_ip, are enabled, the resulting index will not write SESSION_ID

The minimum PCAP file size is 100 MB

VLAN Mirroring

Service 17 includes mirroring subscriber traffic to a specific VLAN, which is added to the data ports of SSG. The traffic direction is preserved.

Configuration in fastdpi.conf:

span_vlan=123
span_trace=1

For diagnostics, you can use one of the parameters in fastdpi.conf:

trace_ip
span_trace
ajb_save_emit

Enabling VLAN mirroring:

fdpi_ctrl load --service 17 --ip 192.168.1.1
fdpi_ctrl load --service 17 --login USER101

Disabling VLAN mirroring:

fdpi_ctrl del --service 17 --ip 192.168.1.1
fdpi_ctrl del --service 17 --login USER101

If both services 12 and 17 are enabled, the PCAP will show both the original and mirrored recordings.