PCAP Record Management and VLAN Mirroring
PCAP record management
12 service includes PCAP recording for all subscriber traffic. The PCAP file is placed in the path specified in the basic configuration in fastdpi.conf:
ajb_udpi_path
In 12 service, the PCAP is written at the subscriber level when processing has taken place and the policing and services have been applied to the subscriber.
One can control start and stop of the recording on the platform by SM fdpi_ctrl utility when the parameter ajb_reserved=1 is set:
fdpi_ctrl setenv --ajb_save_url 1 fdpi_ctrl setenv --ajb_save_udpi 1
Enabling PCAP recording:
fdpi_ctrl load --service 12 --ip 192.168.1.1 fdpi_ctrl load --service 12 --login USER101
Disabling PCAP recording:
fdpi_ctrl del --service 12 --ip 192.168.1.1 fdpi_ctrl del --service 12 --login USER101
To quickly find data in a PCAP file, you can create a file with indexed data by turning on the settings in /etc/dpi/fastdpi.conf:
ajb_pcap_ind_mask=1
Here:
- 0 - index is not created (default value)
- 1 - IPv4
- 2 - IPv6
- 3 - both IPv4 and IPv6.
If other recording methods are enabled for this subscriber (ajb_save_udpi or ajb_save_ip), then SESSION_ID will be not recorded to the resulting index.
Mirroring on a VLAN
17 service includes mirroring of subscriber traffic to a specific VLAN that is swept into the data ports of the SCAT. the traffic direction is preserved.
Setup in fastdpi.conf:
span_vlan=123 span_trace=1
You can use one of the parameters in fastdpi.conf for diagnostics:
trace_ip span_trace ajb_save_emit
If we set service 12 and 17, we will see the original recording and the mirrored recording in PCAP.