Capture Setup2 - Filters
- Yuki Bradley Kondo
Capture Setting pages provide a variety of filter options.
These filters can be applied before initiating the capturing process.
Merge Port #
Enable this can merge 2 ports, and capture the aggregated traffic. Merge is supported between port 0 with port1, port 2 with port 3, and port 4 with port 5. (Refer to Merge Port Capturing )
Compression
Compresses the file after writing to that file is complete. This works best when capturing using increment mode.
Rotational
When the volume reaches the threshold value (depending on the configuration of the QP), the oldest PCAP and compressed PCAP are deleted to make room for the newest PCAP captures.
Regarding Rotation: By default, the threshold is set at 5%. The rotation mechanism becomes operational as soon as the capacity reaches 95%. This process involves the removal of the oldest files until the capacity returns to 95%. However, please note that the rotation process cannot be applied to the /cifs/capture/permanent directory. This particular directory is exempt from rotation, as the files within it can only be deleted intentionally by a user who wishes to remove them.
Optimal Conditions for Rotation:
For 1Gbps sustained capturing, it will be good to have at least 5 minutes worth of buffer space.
So 1Gbps x 300 seconds = 300GB -> 300Gb/(8bit/byte) = 37.5GB
(Optimal Volume Capacity) x 5% = 37.5GB
(Optimal Volume Capacity) = 750GB
For 10Gbps sustained capturing:
10Gbps x 300 seconds = 3Tb -> 3Tb/(8bit/byte) = 375GB
(Optimal Volume Capacity) x 5% = 375GB
(Optimal Volume Capacity) = 7.5TB
OoS Detect
After starting capturing with OoS-Detect (Out-of-Sync Detection) enabled, the Capture Preview section of the Capture Panel will display alerts in an event that it detects any possible Out-of-Sync packet. Mostly used for multicast traffic.
Interval/File
This field is enabled after checking the Increment File checkbox. Choosing By File Size from the drop-down list brings the size field for selecting a file size.
Increment by Time
Increments the file by time (for 10 seconds to 30 minutes) even when the capture has not received any packets in that interval. This option is selected from the Interval/ File drop-down menu.
Increment by Packets
Increments the file by the number of packets form (100 to 1,000,000 packets); it is recommended to increment using less than 100,000 packets for slow speed capturing only. This option is selected from the Interval/File drop-down menu.
Increment by File Size
Increment by the size of the file in megabytes. It has an upper limit of incrementing up to 4000MB and the lowest limit of 50MB. Note: In the Interval/File drop-down menu, select By File Size.
Packet Slicing(Bytes)
Slice the packets according to the specified size. Currently, we don't have restrictions on the packet slicing, if you would like most just the header and some payload; set to 128B. If you would like the minimum header set to 64B.
Port Link Status
"Up" signifies the successful establishment of a connection between the port and its source.
"Down" indicates a potential issue such as a loose connection or an inactive source interface. If the link status is not "Up," consider restarting the driver to troubleshoot the situation.
Virtual Capture Setting
Turning the filtering settings on will enable the filter settings. Turning it off will dis- able these settings. Refer to Virtual Capture Settings.
To learn how to configure filters, kindly refer to the following link: Capture Setup3 - Virtual Capture Settings