Capture Setting pages provide a variety of filter options.
...
These are filters you can apply be applied before starting initiating the capturing process.
| Table of Contents |
|---|
Merge Port #
Enable this can merge 2 ports, and capture the aggregated traffic. Merge is supported between port 0 with port1, port 2 with port 3, and port 4 with port 5. (Refer to Merge Port Capturing )
Compression
Compresses the file after writing to that file is complete. This works best when capturing using increment mode.
...
When the volume reaches the threshold value (depending on the configuration of the QP), the oldest PCAP and compressed PCAP are deleted to make room for the newest PCAP captures.
...
Regarding Rotation: By default, the threshold is set at 5%. The rotation mechanism becomes operational as soon as the capacity reaches 95%. This process involves the removal of the oldest files until the capacity returns to 95%. However, please note that the rotation process cannot be applied to the /cifs/capture/permanent directory. This particular directory is exempt from rotation, as the files within it can only be deleted intentionally by a user who wishes to remove them.
Optimal Conditions for Rotation:
For 1Gbps sustained capturing, it will be good to have at least 5 minutes worth of buffer space.
So 1Gbps x 300 seconds = 300GB -> 300Gb/(8bit/byte) = 37.5GB
(Optimal Volume Capacity) x 5% = 37.5GB
(Optimal Volume Capacity) = 750GB
For 10Gbps sustained capturing:
10Gbps x 300 seconds = 3Tb -> 3Tb/(8bit/byte) = 375GB
(Optimal Volume Capacity) x 5% = 375GB
(Optimal Volume Capacity) = 7.5TB
OoS Detect
After starting capturing with OoS-Detect (Out-of-Sync Detection) enabled, the Capture Preview section of the Capture Panel will display alerts in an event that it detects any possible Out-of-Sync packet. Mostly used for multicast traffic.
...
Slice the packets according to the specified size. Currently, we don't have restrictions on the packet slicing, if you would like most just the header and some payload; set to 128B. If you would like the minimum header set to 64B.
Port Link Status
...
"Up" signifies the successful establishment of a connection between the port and its source.
"Down" indicates a potential issue such as a loose connection or an inactive source interface. If the link status is not "Up," consider restarting the driver to troubleshoot the situation.
Virtual Capture Setting
Turning the filtering settings on will enable the filter settings. Turning it off will dis- able these settings. Refer to Virtual Capture Settings.
To learn how to configure filters, kindly refer to the following link: Capture Setup3 - Virtual Capture SettingSettings