1,775
edits
Capture module: Difference between revisions
Jump to navigation
Jump to search
no edit summary
No edit summary |
No edit summary |
||
| Line 233: | Line 233: | ||
'''– HTTP download''' | :'''– HTTP download''' | ||
:This is the default method. The capture will start a HTTP download of a PCAP file directly in the browser. | :This is the default method. The capture will start a HTTP download of a PCAP file directly in the browser. | ||
| Line 239: | Line 239: | ||
''' – Disk''' | :''' – Disk''' | ||
:This method is only visible if a storage device is active and has some amount of free storage space. The capture will create a PCAP file on the storage device. | :This method is only visible if a storage device is active and has some amount of free storage space. The capture will create a PCAP file on the storage device. | ||
''' – Interface''' | :''' – Interface''' | ||
:This mode will transmit the captured packets on a physical network interface. It is not available when the system is analyzing a PCAP file or is analyzing the packet ring buffer. | :This mode will transmit the captured packets on a physical network interface. It is not available when the system is analyzing a PCAP file or is analyzing the packet ring buffer. | ||
''' – ERSPAN ''' | :''' – ERSPAN ''' | ||
:This mode will transmit the captured packets encapsulated in a GRE + ERSPAN header on the management interface to a given target IP address. On the target system the traffic can be selectively captured using the filter '''ip proto 0x2f''' when using an application like Wireshark or tcpdump. | :This mode will transmit the captured packets encapsulated in a GRE + ERSPAN header on the management interface to a given target IP address. On the target system the traffic can be selectively captured using the filter '''ip proto 0x2f''' when using an application like Wireshark or tcpdump. | ||
| Line 256: | Line 256: | ||
'''– none''' | :'''– none''' | ||
:No limit will be applied and the packets are transmitted as fast as the network interface and the packet ring buffer allow. | :No limit will be applied and the packets are transmitted as fast as the network interface and the packet ring buffer allow. | ||
'''– limit to bandwidth''' | :'''– limit to bandwidth''' | ||
:A bandwidth limit will be applied so that the given bandwidth in Mbps is not exceeded. The bandwidth can be given as a decimal so that e.g. 500kbps can be configured with a value of 0.5. | :A bandwidth limit will be applied so that the given bandwidth in Mbps is not exceeded. The bandwidth can be given as a decimal so that e.g. 500kbps can be configured with a value of 0.5. | ||
'''– realtime factor''' | :'''– realtime factor''' | ||
:Packets will be transmitted based on their recorded timing information. This means that with a real time factor of 1.0 packets will be transmitted approximately with the same timing as they were originally received. Using for example a real time factor of 2.0 would transmit the packets with twice the speed than they were received. | :Packets will be transmitted based on their recorded timing information. This means that with a real time factor of 1.0 packets will be transmitted approximately with the same timing as they were originally received. Using for example a real time factor of 2.0 would transmit the packets with twice the speed than they were received. | ||
| Line 276: | Line 276: | ||
Possible values are: | Possible values are: | ||
'''– Full length ''' | :'''– Full length ''' | ||
'''– 64 Bytes ''' | :'''– 64 Bytes ''' | ||
'''– 1500 Bytes ''' | :'''– 1500 Bytes ''' | ||
'''– Custom length with an input field for inserting any length between 64 and 15378 Bytes ''' | :'''– Custom length with an input field for inserting any length between 64 and 15378 Bytes ''' | ||
| Line 290: | Line 290: | ||
This section is only shown when the Capture type is either HTTP or disk. | This section is only shown when the Capture type is either HTTP or disk. | ||
'''– Omit interface ID:''' Enabling this option will generate a PCAP file that only contains a single interface and treats all packets as if they arrived on that interface. This may improve compatibility with third party software that cannot handle PCAPs with multiple interfaces IDs. | :'''– Omit interface ID:''' Enabling this option will generate a PCAP file that only contains a single interface and treats all packets as if they arrived on that interface. This may improve compatibility with third party software that cannot handle PCAPs with multiple interfaces IDs. | ||
After pushing the '''Start capture''' button, the capture starts. | :After pushing the '''Start capture''' button, the capture starts. | ||