19
edits
Process traffic capture from remote device: Difference between revisions
Process traffic capture from remote device (view source)
Revision as of 12:08, 18 September 2024
, 18 September 2024added parallel remote packets
No edit summary |
(added parallel remote packets) |
||
| Line 18: | Line 18: | ||
The [[System Info Page]] shows the current packet processing mode, indicating whether live traffic from local network interface is processed, live traffic from the TCP port, or a pcap file from the storage device is analyzed. | The [[System Info Page]] shows the current packet processing mode, indicating whether live traffic from local network interface is processed, live traffic from the TCP port, or a pcap file from the storage device is analyzed. | ||
===== Parallel remote packets ===== | |||
Starting with version 4.3 there is now the option to run the remote packet processing in parallel to the live analysis just like a parallel PCAP analysis or parallel Packet Ring Buffer analysis. For this to work the PCAP parallel analysis feature must be enabled (see [[PCAP parallel analysis]]). | |||
In the tab ''Parallel remote packets'' the following parameters can be set: | |||
* '''Port number:''' the port on which this parallel remote packet processing should listen for incoming connections | |||
* '''Name:''' a name displayed on the Top User Dashboard when the replay slot is selected (optional) | |||
* '''Description:''' a description displayed on the Top User Dashboard when the replay slot is selected (optional) | |||
* '''Analysis Profile:''' a settings profile to be used for the parallel remote packet processing (see [[Pcap analysis module]]) | |||
* '''Replay Slot:''' the replay slot to be used for the parallel remote packet processing | |||
A checkbox ''Use a temporary Packet Ring Buffer for the parallel remote packets analysis'' can be enabled to let the the parallel remote packet analysis use a Packet Ring Buffer on the selected storage device. This Packet Ring Buffer and all its contents will be deleted once the remote packets analysis ends. Selecting this checkbox shows the following additional settings: | |||
* '''Storage device:''' the storage device on which to create the temporary Packet Ring Buffer | |||
* '''Ring buffer size in MB:''' the size of the temporary Packet Ring Buffer in MB | |||
Once the ''Start parallel remote packets'' button is pressed the user interface can be switched between the parallel remote packets analysis and live analysis just like with the parallel PCAP analysis by selecting the respective replay slot. The processing can be stopped in the ''Parallel remote packets'' tab or on the Top user dashboard when the replay slot is selected. | |||
'''Web Interface''' | '''Web Interface''' | ||