PCAP Recording Management [Документация VAS Experts]
Документация VAS Experts Документация VAS Experts-mobile
in

Settings

  • Show pagesource
  • Export to PDF
  • Backlinks
  • Show pagesource
  • Export to PDF
  • Backlinks
    •   Stingray Service Gateway by VAS ExpertsSSG componentsFastDPI (DPI, BNG, NAT functions)PCAP Recording Management

    Table of Contents

    Services Service 12 PCAP Recording

    PCAP Recording Management

    12 Service enables PCAP recording for all subscriber traffic. PCAP files are stored in the directory specified by the ajb_udpi_path parameter in the fastdpi.conf file: 

    ajb_udpi_path
    In 12 Service, PCAP recording is performed at the subscriber level after traffic processing is completed, when policing and services have already been applied to the subscriber.

    When the ajb_reserved=1 parameter is enabled, PCAP recording on the platform can be started and stopped using the fdpi_ctrl utility for SM. 

    fdpi_ctrl setenv --ajb_save_url  1
fdpi_ctrl setenv --ajb_save_udpi 1

    Enable recording: 

    fdpi_ctrl load --service 12 --ip 192.168.1.1
fdpi_ctrl load --service 12 --login USER101

    Disable recording: 

    fdpi_ctrl del --service 12 --ip 192.168.1.1
fdpi_ctrl del --service 12 --login USER101

    Recording PCAP from a network port

    To record traffic directly from a network port, use the following command: 

    fdpi_cli dev pcap <dev-name> rx|tx|any|off

    Where:

    • rx — record packets received by the port.
    • tx — record packets transmitted through the port.
    • any — record both incoming and outgoing traffic.
    • off — stop recording.

    The generated PCAP files use the following prefixes:

    • rx-<dev-name> — incoming traffic.
    • tx-<dev-name> — outgoing traffic.

    PCAP indexing

    To speed up data searches in PCAP files, you can enable index file generation by setting the ajb_pcap_ind_mask parameter in the /etc/dpi/fastdpi.conf file: 

    ajb_pcap_ind_mask=1

    Possible values:

    • 0 — index is not generated (default).
    • 1 — index IPv4 packets.
    • 2 — index IPv6 packets.
    • 3 — index both IPv4 and IPv6 packets.
    If other recording methods are enabled for the same subscriber (ajb_save_udpi or ajb_save_ip), the SESSION_ID field is not written to the index file.
    The minimum PCAP file size is 100 MB.

    PCAP by IP and CIDR

    To start recording IP or CIDR traffic (0.0.0.0/0 - to record all traffic) 

    ajb_save_ip=192.168.0.0/24

    This is a "hot" parameter, so this list can be changed with the command: service fastdpi reload

    ajb_save_ip works independently of the subscriber on the input itself and writes all subscriber traffic before services and policing were applied to it.

    If you set the configuration parameter 

    ajb_reserved=1

    the memory for the record buffer is allocated in advance (at DPI start) and you can start and stop data recording on the run. You only need to change parameters ajb_save_url, ajb_save_udpi and ajb_save_ip.

    To record the data in PCAP format: please use the following parameters in configuration file /etc/dpi/fastdpi.conf: 

    ajb_save_udpi=1
ajb_save_udpi_proto=OSPFIGP:ospf-lite
ajb_udpi_path=/var/dump/dpi

    Here:

    • ajb_save_udpi=1 - activate the traffic recording for a list of protocols
    • ajb_udpi_path=/var/dump/dpi - is a directory to place log files (/var/dump/dpi by default)
    • ajb_save_udpi_proto=OSPFIGP:ospf-lite - is a list of protocols to record as test or numerical identificators. This is a hot parameter. It can be changed on the run by command service fastdpi reload.
    You can also activate service 12 (traffic recording) individually for each subscriber.

    PCAP files index mask

    • 0 - not created
    • 1 - via IPv4
    • 2 - via IPv6
    • 3 - via both IPv4 and IPv6.
    ajb_pcap_ind_mask=0 // not created
ajb_pcap_ind_mask=1 // via IPv4
ajb_pcap_ind_mask=2 // via IPv6
ajb_pcap_ind_mask=3 // via both IPv4 and IPv6

    This is a hot parameter. It can be changed on the run by command service fastdpi reload.

    PCAP by VLAN

    PCAP recording by VLAN is controlled by the parameter: 

    ajb_save_vlan

    Possible values:

    • n — record to PCAP only with the condition vlan-id == n (qinq will not be recorded, even if svlan-id == n)
    • n.m — record to PCAP only if svlan-id == n, cvlan-id == m
    • n.0 — record to PCAP if svlan-id == n, cvlan-id == any

    Only one active selection rule for recording is supported.
    Rotation is performed under general conditions (similar to ajb_save_ip).

    Was this information helpful?