Packet ring buffer: Difference between revisions

Upon clicking on it an empty packet ring buffer is created. To actually store data, storage space needs to allocated to the Packet Ring Buffer. In the ''Configuration'' tab by clicking on a ''Allocate space for Packet Ring Buffer'' button, a dialogue will be displayed and allows you to specify the size of the ring buffer.  

It must be ensured that enough space is available on the external storage device.  

'''Web interface'''

|-

|}

* Timestamp of oldest packet: The timestamp of the oldest packet in the ring buffer.

:The raw on-disk value will be displayed next to it in parentheses.

:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than zero replication, an adjusted value is displayed to reflect the redundant copies of packet data. The raw on-disk value will be displayed next to it in parentheses.

:This value may be larger than the used size in case the ring buffer is full and parts of it were overwritten.

:The history graph shows the captured traffic of the last minute or in the selected interval (if set).

:If larger bursts of traffic need to be stored in this queue, the size can be modified in the capture module settings.

When the ring buffer is full and old packets are deleted, the graphs will show the time range with no data with a dark grey background colour.  

The time range before start of the ring buffer will be visualized in the same way.

The capture will also continue with live traffic.  

If the user interface is in '''back-in-time''' mode (a timespan from the past is selected) starting a capture will produce a dialogue asking to confirm that the capture will cover exactly the timespan selected.  

|-

|}

option `The maximum number of concurrent packet ring buffers` in the

capture module options can be set to the required number.

This level controls how many redundant copies of each packet are written.  

No replication means that only a single copy of each packet is written and provides no redundancy.  

'''Web interface'''

The following columns are displayed in the list:

'''Web interface'''

|-

|}

Rules can be configured to control the snapshot length of each packet which will be stored in the packet ring buffer.  

These rules can also be used to prevent certain packets from being stored in the packet ring buffer.  

:{| class="wikitable"

|-

|-

| everything

|-

|-

|-

|-

|-

|-

|-

| interface

|-

|

The number matches part of the 'From:', 'To:', 'Request-URI', 'Contact', 'P-Asserted-Identity' or 'P-Preferred-Identity' entry in a SIP INVITE packet.

Correlating SIP packets for the same Call-ID will match.

The RTP and RTCP packets correlated to this SIP call will also match.

|-

|-

|-

|SSL after handshake

|}

:If this is on, the value must not match.

:{| class="wikitable"

|-

|-

|-

|-

|-

|

Capture just certain parts of the packet.

|}

When the packet ring buffer is activated, it is possible to restart the packet processing core and analyze all packets contained in the packet ring buffer.  

When the Analyze packet ring buffer button is pressed, a dialogue will appear which allows you to choose the time range of the packet ring buffer which is to be replayed.  

When the packet ring buffer is active, the entire contents can be extracted by capturing the complete timespan that is contained within.  

For convenience, a button labelled Extract packet ring buffer is available that opens the capture dialogue with the start time and end time set to the appropriate values.