Process traffic capture from remote device

From Allegro Packets Product Wiki
Jump to navigation Jump to search

The Allegro Network Multimeter can also be switched into a special mode to receive pcap stream via TCP from any remote device. It is possible to process plain pcap files or use an additional tool to capture traffic and send it to the Allegro Network Multimeter.

This mode can be enabled or disabled, and if enabled, the port for receive packet streams can be configured. Be aware that this port is plain unencrypted TCP!

If changes to these settings are made, a restart of the measurement application is required, which can be done in the Administration page.

Every pcap file streamed to the TCP socket will be processed as it would be analysed locally from an connected storage device. Up to 16 connections can be used simultaneously. Since the internal clock depends on the packet time, all clocks of the sources should be (almost) synchronous (for example by using NTP time synchronization).

To analyze a bunch of files chronologically, stream the files one at a time to the Multimeter. The timestamps of the actual packets are used for the internal time clock of the Allegro Network Multimeter so network problems and events can be traced back to the actual time they happened.

The clock of multiple files should not run backwards, i.e. when a file from an older capture time is processed after a file from a newer capture time. If such files need to be analyzed, the measurement core should be started via the Administration page.

The System Info Page shows the current packet processing mode, indicating whether live traffic from local network interface is processed, live traffic from the TCP port, or a pcap file from the storage device is analyzed.

Web Interface

Process traffic capture from remote device.png

Receive packets from remote capture device

Example uses

The capturing tool can be downloaded from the Remote packets page in the Generic section. The tool allows to capture packets from any or an specific network device, and also to stream a file to the Allegro Network Manager:

  • Processing a local pcap file:
./ap_capture_to_remote -f trace.pcap allegro-mm-abcd 8001
  • Live-capture from eth0:
sudo ./ap_capture_to_remote -i eth0 allegro-mm-abcd 8001
   

or permit access to network interfaces only instead of full root permissions:

sudo setcap cap_net_raw=ep ap_capture_to_remote
./ap_capture_to_remote -i eth0 allegro-mm-abcd 8001
  • Live-capture from all network devices:
sudo ./ap_capture_to_remote allegro-mm-abcd 1234

In all examples, host and port number must be set according to the actual Allegro Network Multimeter device and the configured port number.

Process traffic capture from remote device1.png

Alternative tools

The Allegro Network Multimeter also accepts plain pcap files on the configured port. That means it is possible to stream files to the device or use tcpdump with additional filters.

Example uses are:

  • Processing a local pcap file:
cat trace.pcap | netcat allegro-mm-abcd 1234
  • Live-capture via tcpdump:
sudo tcpdump -i eth0 -s 0 -U -w /dev/stdout | netcat allegro-mm-abcd 1234