<?xml version="1.0"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
	<id>https://allegro-packets.com/wiki/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=David.Griffiths</id>
	<title>Allegro Network Multimeter Manual - User contributions [en]</title>
	<link rel="self" type="application/atom+xml" href="https://allegro-packets.com/wiki/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=David.Griffiths"/>
	<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/Special:Contributions/David.Griffiths"/>
	<updated>2026-04-04T12:21:08Z</updated>
	<subtitle>User contributions</subtitle>
	<generator>MediaWiki 1.39.13</generator>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Burst_analysis_on_a_Mirror_or_Packet_Broker_input&amp;diff=3073</id>
		<title>Burst analysis on a Mirror or Packet Broker input</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Burst_analysis_on_a_Mirror_or_Packet_Broker_input&amp;diff=3073"/>
		<updated>2020-10-14T14:38:54Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* MAC Burst Measurement */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Problem ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter is connected to a Mirror or Packet Broker port. By default, this makes it difficult to analyse a specific link for bursts since the packets are aggregated on the Mirror or Packet Broker port.&lt;br /&gt;
&lt;br /&gt;
Please note that this guide is based on the manual [[Burst analysis]] and on the use case guide [[Network Burst Analysis]].&lt;br /&gt;
&lt;br /&gt;
== Link Burst Measurement ==&lt;br /&gt;
&lt;br /&gt;
By default, the Allegro Network Multimeter measures the bursts per interface at &#039;&#039;&#039;L2 Ethernet&#039;&#039;&#039; → &#039;&#039;&#039; Burst Analysis&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
[[File:Burst link measurement.png|500px]]&lt;br /&gt;
&lt;br /&gt;
Here you can configure the speed per link as the maximum speed. The percent values displayed are based on that maximum speed.&lt;br /&gt;
&lt;br /&gt;
== MAC Burst Measurement ==&lt;br /&gt;
&lt;br /&gt;
To analyse a specific link, you can use the MAC burst analysis. This is shown in the second tab &#039;&#039;&#039;MACs&#039;&#039;&#039; in the burst analysis module. It allows you to set a specific receive and send bandwidth for a chosen MAC address. Up to five MAC addresses can be analysed. If you have an uplink, simply use the Router´s MAC address here and then specify the maximum receive and send rate of the Router´s uplink.&lt;br /&gt;
&lt;br /&gt;
In this example, we configured maximum values of 250MBit/s for the downlink and 40MBit/s for the uplink for the Router MAC address.&lt;br /&gt;
&lt;br /&gt;
[[File:Burst mac measurement.png|500px]]&lt;br /&gt;
&lt;br /&gt;
Please note that the burst analysis is done with 1 millisecond resolution by default. In our example, the Router is connected at 1GBit/s and it can receive more than the configured uplink bandwidth. This is shown in the display as a utilisation of &amp;quot;&amp;gt;&amp;gt; 100%&amp;quot; and indicates that a burst may not be able to be handled by this uplink.&lt;br /&gt;
&lt;br /&gt;
== Advantage for Mirror Port and Packet Brokers ==&lt;br /&gt;
&lt;br /&gt;
The MAC burst detection can be used for a specific end device ( a file server,... ) or for the gateway of an uplink ( Router,... ). It allows to monitor links and end devices even in out-of-band installations.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Burst_analysis_on_a_Mirror_or_Packet_Broker_input&amp;diff=3072</id>
		<title>Burst analysis on a Mirror or Packet Broker input</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Burst_analysis_on_a_Mirror_or_Packet_Broker_input&amp;diff=3072"/>
		<updated>2020-10-14T14:37:34Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* MAC Burst Measurement */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Problem ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter is connected to a Mirror or Packet Broker port. By default, this makes it difficult to analyse a specific link for bursts since the packets are aggregated on the Mirror or Packet Broker port.&lt;br /&gt;
&lt;br /&gt;
Please note that this guide is based on the manual [[Burst analysis]] and on the use case guide [[Network Burst Analysis]].&lt;br /&gt;
&lt;br /&gt;
== Link Burst Measurement ==&lt;br /&gt;
&lt;br /&gt;
By default, the Allegro Network Multimeter measures the bursts per interface at &#039;&#039;&#039;L2 Ethernet&#039;&#039;&#039; → &#039;&#039;&#039; Burst Analysis&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
[[File:Burst link measurement.png|500px]]&lt;br /&gt;
&lt;br /&gt;
Here you can configure the speed per link as the maximum speed. The percent values displayed are based on that maximum speed.&lt;br /&gt;
&lt;br /&gt;
== MAC Burst Measurement ==&lt;br /&gt;
&lt;br /&gt;
To analyse a specific link, you can use the MAC burst analysis. This is shown in the second tab &#039;&#039;&#039;MACs&#039;&#039;&#039; in the burst analysis module. It allows you to set a specific receive and send bandwidth for a chosen MAC address. Up to five MAC addresses can be analysed. If you have an uplink, simply use the Router´s MAC address here and then specify the maximum receive and send rate of the Router´s uplink.&lt;br /&gt;
&lt;br /&gt;
In this example, we configured maximum values of 250MBit/s for the downlink and 40MBit/s for the uplink for the Router MAC address.&lt;br /&gt;
&lt;br /&gt;
[[File:Burst mac measurement.png|500px]]&lt;br /&gt;
&lt;br /&gt;
Please note that the burst analysis is done with 1 millisecond resolution by default. In our example, the router is connected with 1GBit/s and it can receive more than the configured uplink bandwidth. This is shown in the display as an utilization of &amp;quot;&amp;gt;&amp;gt; 100%&amp;quot; and indicates that a burst might not be able to be handled by this uplink.&lt;br /&gt;
&lt;br /&gt;
== Advantage for Mirror Port and Packet Brokers ==&lt;br /&gt;
&lt;br /&gt;
The MAC burst detection can be used for a specific end device ( a file server,... ) or for the gateway of an uplink ( Router,... ). It allows to monitor links and end devices even in out-of-band installations.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Burst_analysis_on_a_Mirror_or_Packet_Broker_input&amp;diff=3071</id>
		<title>Burst analysis on a Mirror or Packet Broker input</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Burst_analysis_on_a_Mirror_or_Packet_Broker_input&amp;diff=3071"/>
		<updated>2020-10-14T14:36:56Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* MAC Burst Measurement */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Problem ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter is connected to a Mirror or Packet Broker port. By default, this makes it difficult to analyse a specific link for bursts since the packets are aggregated on the Mirror or Packet Broker port.&lt;br /&gt;
&lt;br /&gt;
Please note that this guide is based on the manual [[Burst analysis]] and on the use case guide [[Network Burst Analysis]].&lt;br /&gt;
&lt;br /&gt;
== Link Burst Measurement ==&lt;br /&gt;
&lt;br /&gt;
By default, the Allegro Network Multimeter measures the bursts per interface at &#039;&#039;&#039;L2 Ethernet&#039;&#039;&#039; → &#039;&#039;&#039; Burst Analysis&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
[[File:Burst link measurement.png|500px]]&lt;br /&gt;
&lt;br /&gt;
Here you can configure the speed per link as the maximum speed. The percent values displayed are based on that maximum speed.&lt;br /&gt;
&lt;br /&gt;
== MAC Burst Measurement ==&lt;br /&gt;
&lt;br /&gt;
To analyse a specific link, you can use the MAC burst analysis. This is shown in the second tab &#039;&#039;&#039;MACs&#039;&#039;&#039; in the burst analysis module. It allows you to set a specific receive and send bandwidth for a certain MAC address. Up to five MAC addresses can be analysed. If you have an uplink, simply use the Router´s MAC address here and then specify the maximum receive and send rate of the Router´s uplink.&lt;br /&gt;
&lt;br /&gt;
In this example, we configured maximum values of 250MBit/s for the downlink and 40MBit/s for the uplink for the Router MAC address.&lt;br /&gt;
&lt;br /&gt;
[[File:Burst mac measurement.png|500px]]&lt;br /&gt;
&lt;br /&gt;
Please note that the burst analysis is done with 1 millisecond resolution by default. In our example, the router is connected with 1GBit/s and it can receive more than the configured uplink bandwidth. This is shown in the display as an utilization of &amp;quot;&amp;gt;&amp;gt; 100%&amp;quot; and indicates that a burst might not be able to be handled by this uplink.&lt;br /&gt;
&lt;br /&gt;
== Advantage for Mirror Port and Packet Brokers ==&lt;br /&gt;
&lt;br /&gt;
The MAC burst detection can be used for a specific end device ( a file server,... ) or for the gateway of an uplink ( Router,... ). It allows to monitor links and end devices even in out-of-band installations.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Burst_analysis_on_a_Mirror_or_Packet_Broker_input&amp;diff=3070</id>
		<title>Burst analysis on a Mirror or Packet Broker input</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Burst_analysis_on_a_Mirror_or_Packet_Broker_input&amp;diff=3070"/>
		<updated>2020-10-14T14:31:29Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* Problem */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Problem ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter is connected to a Mirror or Packet Broker port. By default, this makes it difficult to analyse a specific link for bursts since the packets are aggregated on the Mirror or Packet Broker port.&lt;br /&gt;
&lt;br /&gt;
Please note that this guide is based on the manual [[Burst analysis]] and on the use case guide [[Network Burst Analysis]].&lt;br /&gt;
&lt;br /&gt;
== Link Burst Measurement ==&lt;br /&gt;
&lt;br /&gt;
By default, the Allegro Network Multimeter measures the bursts per interface at &#039;&#039;&#039;L2 Ethernet&#039;&#039;&#039; → &#039;&#039;&#039; Burst Analysis&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
[[File:Burst link measurement.png|500px]]&lt;br /&gt;
&lt;br /&gt;
Here you can configure the speed per link as the maximum speed. The percent values displayed are based on that maximum speed.&lt;br /&gt;
&lt;br /&gt;
== MAC Burst Measurement ==&lt;br /&gt;
&lt;br /&gt;
To analyse a specific link, you can use the MAC burst analysis. This is shown in the second tab &#039;&#039;&#039;MACs&#039;&#039;&#039; in the burst analysis module. It allows to set a specific receive and send bandwidth for a certain MAC address. Up to five MAC addresses can be analysed. If you have an uplink, simply use the Router´s MAC address here and then specify the maximum receive and send rate of the Router´s uplink.&lt;br /&gt;
&lt;br /&gt;
In this example, we configured maximum values of 250MBit/s for the downlink and 40MBit/s for the uplink for the Router MAC address.&lt;br /&gt;
&lt;br /&gt;
[[File:Burst mac measurement.png|500px]]&lt;br /&gt;
&lt;br /&gt;
Please note that the burst analysis is done with 1 millisecond resolution by default. In our example, the router is connected with 1GBit/s and it can receive more than the configured uplink bandwidth. This is shown in the display as an utilization of &amp;quot;&amp;gt;&amp;gt; 100%&amp;quot; and indicates that a burst might not be able to be handled by this uplink.&lt;br /&gt;
&lt;br /&gt;
== Advantage for Mirror Port and Packet Brokers ==&lt;br /&gt;
&lt;br /&gt;
The MAC burst detection can be used for a specific end device ( a file server,... ) or for the gateway of an uplink ( Router,... ). It allows to monitor links and end devices even in out-of-band installations.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Burst_analysis_on_a_Mirror_or_Packet_Broker_input&amp;diff=3069</id>
		<title>Burst analysis on a Mirror or Packet Broker input</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Burst_analysis_on_a_Mirror_or_Packet_Broker_input&amp;diff=3069"/>
		<updated>2020-10-14T14:08:11Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* MAC Burst measurement */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Problem ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter is connected to a mirror or packet broker port. By default, this makes it difficult to analyse a specific link for bursts since the packets are aggregated on the mirror or packet broker port.&lt;br /&gt;
&lt;br /&gt;
Please note that this guide is based on the manual [[Burst analysis]] and on the use case guide [[Network Burst Analysis]].&lt;br /&gt;
&lt;br /&gt;
== Link Burst Measurement ==&lt;br /&gt;
&lt;br /&gt;
By default, the Allegro Network Multimeter measures the bursts per interface at &#039;&#039;&#039;L2 Ethernet&#039;&#039;&#039; → &#039;&#039;&#039; Burst Analysis&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
[[File:Burst link measurement.png|500px]]&lt;br /&gt;
&lt;br /&gt;
Here you can configure the speed per link as the maximum speed. The percent values displayed are based on that maximum speed.&lt;br /&gt;
&lt;br /&gt;
== MAC Burst Measurement ==&lt;br /&gt;
&lt;br /&gt;
To analyse a specific link, you can use the MAC burst analysis. This is shown in the second tab &#039;&#039;&#039;MACs&#039;&#039;&#039; in the burst analysis module. It allows to set a specific receive and send bandwidth for a certain MAC address. Up to five MAC addresses can be analysed. If you have an uplink, simply use the Router´s MAC address here and then specify the maximum receive and send rate of the Router´s uplink.&lt;br /&gt;
&lt;br /&gt;
In this example, we configured maximum values of 250MBit/s for the downlink and 40MBit/s for the uplink for the Router MAC address.&lt;br /&gt;
&lt;br /&gt;
[[File:Burst mac measurement.png|500px]]&lt;br /&gt;
&lt;br /&gt;
Please note that the burst analysis is done with 1 millisecond resolution by default. In our example, the router is connected with 1GBit/s and it can receive more than the configured uplink bandwidth. This is shown in the display as an utilization of &amp;quot;&amp;gt;&amp;gt; 100%&amp;quot; and indicates that a burst might not be able to be handled by this uplink.&lt;br /&gt;
&lt;br /&gt;
== Advantage for Mirror Port and Packet Brokers ==&lt;br /&gt;
&lt;br /&gt;
The MAC burst detection can be used for a specific end device ( a file server,... ) or for the gateway of an uplink ( Router,... ). It allows to monitor links and end devices even in out-of-band installations.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Burst_analysis_on_a_Mirror_or_Packet_Broker_input&amp;diff=3068</id>
		<title>Burst analysis on a Mirror or Packet Broker input</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Burst_analysis_on_a_Mirror_or_Packet_Broker_input&amp;diff=3068"/>
		<updated>2020-10-14T14:07:44Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* Advantage for Mirror Port and Packet Brokers */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Problem ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter is connected to a mirror or packet broker port. By default, this makes it difficult to analyse a specific link for bursts since the packets are aggregated on the mirror or packet broker port.&lt;br /&gt;
&lt;br /&gt;
Please note that this guide is based on the manual [[Burst analysis]] and on the use case guide [[Network Burst Analysis]].&lt;br /&gt;
&lt;br /&gt;
== Link Burst Measurement ==&lt;br /&gt;
&lt;br /&gt;
By default, the Allegro Network Multimeter measures the bursts per interface at &#039;&#039;&#039;L2 Ethernet&#039;&#039;&#039; → &#039;&#039;&#039; Burst Analysis&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
[[File:Burst link measurement.png|500px]]&lt;br /&gt;
&lt;br /&gt;
Here you can configure the speed per link as the maximum speed. The percent values displayed are based on that maximum speed.&lt;br /&gt;
&lt;br /&gt;
== MAC Burst measurement ==&lt;br /&gt;
&lt;br /&gt;
To analyse a specific link, you can use the MAC burst analysis. This is shown in the second tab &#039;&#039;&#039;MACs&#039;&#039;&#039; in the burst analysis module. It allows to set a specific receive and send bandwidth for a certain MAC address. Up to five MAC addresses can be analysed. If you have an uplink, simply use the Router´s MAC address here and then specify the maximum receive and send rate of the Router´s uplink.&lt;br /&gt;
&lt;br /&gt;
In this example, we configured maximum values of 250MBit/s for the downlink and 40MBit/s for the uplink for the Router MAC address.&lt;br /&gt;
&lt;br /&gt;
[[File:Burst mac measurement.png|500px]]&lt;br /&gt;
&lt;br /&gt;
Please note that the burst analysis is done with 1 millisecond resolution by default. In our example, the router is connected with 1GBit/s and it can receive more than the configured uplink bandwidth. This is shown in the display as an utilization of &amp;quot;&amp;gt;&amp;gt; 100%&amp;quot; and indicates that a burst might not be able to be handled by this uplink.&lt;br /&gt;
&lt;br /&gt;
== Advantage for Mirror Port and Packet Brokers ==&lt;br /&gt;
&lt;br /&gt;
The MAC burst detection can be used for a specific end device ( a file server,... ) or for the gateway of an uplink ( Router,... ). It allows to monitor links and end devices even in out-of-band installations.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Burst_analysis_on_a_Mirror_or_Packet_Broker_input&amp;diff=3067</id>
		<title>Burst analysis on a Mirror or Packet Broker input</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Burst_analysis_on_a_Mirror_or_Packet_Broker_input&amp;diff=3067"/>
		<updated>2020-10-14T14:07:14Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* MAC Burst measurement */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Problem ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter is connected to a mirror or packet broker port. By default, this makes it difficult to analyse a specific link for bursts since the packets are aggregated on the mirror or packet broker port.&lt;br /&gt;
&lt;br /&gt;
Please note that this guide is based on the manual [[Burst analysis]] and on the use case guide [[Network Burst Analysis]].&lt;br /&gt;
&lt;br /&gt;
== Link Burst Measurement ==&lt;br /&gt;
&lt;br /&gt;
By default, the Allegro Network Multimeter measures the bursts per interface at &#039;&#039;&#039;L2 Ethernet&#039;&#039;&#039; → &#039;&#039;&#039; Burst Analysis&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
[[File:Burst link measurement.png|500px]]&lt;br /&gt;
&lt;br /&gt;
Here you can configure the speed per link as the maximum speed. The percent values displayed are based on that maximum speed.&lt;br /&gt;
&lt;br /&gt;
== MAC Burst measurement ==&lt;br /&gt;
&lt;br /&gt;
To analyse a specific link, you can use the MAC burst analysis. This is shown in the second tab &#039;&#039;&#039;MACs&#039;&#039;&#039; in the burst analysis module. It allows to set a specific receive and send bandwidth for a certain MAC address. Up to five MAC addresses can be analysed. If you have an uplink, simply use the Router´s MAC address here and then specify the maximum receive and send rate of the Router´s uplink.&lt;br /&gt;
&lt;br /&gt;
In this example, we configured maximum values of 250MBit/s for the downlink and 40MBit/s for the uplink for the Router MAC address.&lt;br /&gt;
&lt;br /&gt;
[[File:Burst mac measurement.png|500px]]&lt;br /&gt;
&lt;br /&gt;
Please note that the burst analysis is done with 1 millisecond resolution by default. In our example, the router is connected with 1GBit/s and it can receive more than the configured uplink bandwidth. This is shown in the display as an utilization of &amp;quot;&amp;gt;&amp;gt; 100%&amp;quot; and indicates that a burst might not be able to be handled by this uplink.&lt;br /&gt;
&lt;br /&gt;
== Advantage for Mirror Port and Packet Brokers ==&lt;br /&gt;
&lt;br /&gt;
The MAC burst detection can be used for a specific end device ( a file server,... ) or for the gateway of an uplink ( router,... ). It allows to monitor links and end devices even in out-of-band installations.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Burst_analysis_on_a_Mirror_or_Packet_Broker_input&amp;diff=3066</id>
		<title>Burst analysis on a Mirror or Packet Broker input</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Burst_analysis_on_a_Mirror_or_Packet_Broker_input&amp;diff=3066"/>
		<updated>2020-10-14T14:06:31Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* MAC Burst measurement */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Problem ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter is connected to a mirror or packet broker port. By default, this makes it difficult to analyse a specific link for bursts since the packets are aggregated on the mirror or packet broker port.&lt;br /&gt;
&lt;br /&gt;
Please note that this guide is based on the manual [[Burst analysis]] and on the use case guide [[Network Burst Analysis]].&lt;br /&gt;
&lt;br /&gt;
== Link Burst Measurement ==&lt;br /&gt;
&lt;br /&gt;
By default, the Allegro Network Multimeter measures the bursts per interface at &#039;&#039;&#039;L2 Ethernet&#039;&#039;&#039; → &#039;&#039;&#039; Burst Analysis&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
[[File:Burst link measurement.png|500px]]&lt;br /&gt;
&lt;br /&gt;
Here you can configure the speed per link as the maximum speed. The percent values displayed are based on that maximum speed.&lt;br /&gt;
&lt;br /&gt;
== MAC Burst measurement ==&lt;br /&gt;
&lt;br /&gt;
To analyse a specific link, you can use the MAC burst analysis. This is shown in the second tab &#039;&#039;&#039;MACs&#039;&#039;&#039; in the burst analysis module. It allows to set a specific receive and send bandwidth for a certain MAC address. Up to five MAC addresses can be analysed. If you have an uplink, simply use the Router´s MAC address here and then specify the maximum receive and send rate of the Router´s uplink.&lt;br /&gt;
&lt;br /&gt;
In this example, we configured maximum values of 250 MBit/s for the downlink and 40 MBit/s for the uplink for the router MAC address.&lt;br /&gt;
&lt;br /&gt;
[[File:Burst mac measurement.png|500px]]&lt;br /&gt;
&lt;br /&gt;
Please note that the burst analysis is done with 1 millisecond resolution by default. In our example, the router is connected with 1 GBit/s and it can receive more than the configured uplink bandwidth. This is shown in the display as an utilization of &amp;quot;&amp;gt;&amp;gt; 100%&amp;quot; and indicates that a burst that might not be able to be handled by this uplink.&lt;br /&gt;
&lt;br /&gt;
== Advantage for Mirror Port and Packet Brokers ==&lt;br /&gt;
&lt;br /&gt;
The MAC burst detection can be used for a specific end device ( a file server,... ) or for the gateway of an uplink ( router,... ). It allows to monitor links and end devices even in out-of-band installations.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Burst_analysis_on_a_Mirror_or_Packet_Broker_input&amp;diff=3065</id>
		<title>Burst analysis on a Mirror or Packet Broker input</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Burst_analysis_on_a_Mirror_or_Packet_Broker_input&amp;diff=3065"/>
		<updated>2020-10-14T13:58:26Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* Link Burst Measurement */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Problem ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter is connected to a mirror or packet broker port. By default, this makes it difficult to analyse a specific link for bursts since the packets are aggregated on the mirror or packet broker port.&lt;br /&gt;
&lt;br /&gt;
Please note that this guide is based on the manual [[Burst analysis]] and on the use case guide [[Network Burst Analysis]].&lt;br /&gt;
&lt;br /&gt;
== Link Burst Measurement ==&lt;br /&gt;
&lt;br /&gt;
By default, the Allegro Network Multimeter measures the bursts per interface at &#039;&#039;&#039;L2 Ethernet&#039;&#039;&#039; → &#039;&#039;&#039; Burst Analysis&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
[[File:Burst link measurement.png|500px]]&lt;br /&gt;
&lt;br /&gt;
Here you can configure the speed per link as the maximum speed. The percent values displayed are based on that maximum speed.&lt;br /&gt;
&lt;br /&gt;
== MAC Burst measurement ==&lt;br /&gt;
&lt;br /&gt;
To analyze a specific link, you can use the MAC burst analysis. This is shown in the second tab &#039;&#039;&#039;MACs&#039;&#039;&#039; in the burst analysis module. It allows to set a specific receive and send bandwidth for a certain MAC address. Up to five MAC addresses can be analyzed. If you have an uplink, simply use the router´s MAC address here and then specify the maximum receive and send rate of the router´s uplink.&lt;br /&gt;
&lt;br /&gt;
In this example, we configured maximum values of 250 MBit/s for the downlink and 40 MBit/s for the uplink for the router MAC address.&lt;br /&gt;
&lt;br /&gt;
[[File:Burst mac measurement.png|500px]]&lt;br /&gt;
&lt;br /&gt;
Please note that the burst analysis is done with 1 millisecond resolution by default. In our example, the router is connected with 1 GBit/s and it can receive more than the configured uplink bandwidth. This is shown in the display as an utilization of &amp;quot;&amp;gt;&amp;gt; 100%&amp;quot; and indicates that a burst that might not be able to be handled by this uplink.&lt;br /&gt;
&lt;br /&gt;
== Advantage for Mirror Port and Packet Brokers ==&lt;br /&gt;
&lt;br /&gt;
The MAC burst detection can be used for a specific end device ( a file server,... ) or for the gateway of an uplink ( router,... ). It allows to monitor links and end devices even in out-of-band installations.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Burst_analysis_on_a_Mirror_or_Packet_Broker_input&amp;diff=3064</id>
		<title>Burst analysis on a Mirror or Packet Broker input</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Burst_analysis_on_a_Mirror_or_Packet_Broker_input&amp;diff=3064"/>
		<updated>2020-10-14T13:40:52Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* Problem */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Problem ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter is connected to a mirror or packet broker port. By default, this makes it difficult to analyse a specific link for bursts since the packets are aggregated on the mirror or packet broker port.&lt;br /&gt;
&lt;br /&gt;
Please note that this guide is based on the manual [[Burst analysis]] and on the use case guide [[Network Burst Analysis]].&lt;br /&gt;
&lt;br /&gt;
== Link Burst Measurement ==&lt;br /&gt;
&lt;br /&gt;
By default, the Allegro Network Multimeter measures the bursts per interface at &#039;&#039;&#039;L2 Ethernet&#039;&#039;&#039; → &#039;&#039;&#039; Burst Analysis&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
[[File:Burst link measurement.png|500px]]&lt;br /&gt;
&lt;br /&gt;
Here you can configure the speed per link as the maximum speed. The shown percent values are based on that maximum speed.&lt;br /&gt;
&lt;br /&gt;
== MAC Burst measurement ==&lt;br /&gt;
&lt;br /&gt;
To analyze a specific link, you can use the MAC burst analysis. This is shown in the second tab &#039;&#039;&#039;MACs&#039;&#039;&#039; in the burst analysis module. It allows to set a specific receive and send bandwidth for a certain MAC address. Up to five MAC addresses can be analyzed. If you have an uplink, simply use the router´s MAC address here and then specify the maximum receive and send rate of the router´s uplink.&lt;br /&gt;
&lt;br /&gt;
In this example, we configured maximum values of 250 MBit/s for the downlink and 40 MBit/s for the uplink for the router MAC address.&lt;br /&gt;
&lt;br /&gt;
[[File:Burst mac measurement.png|500px]]&lt;br /&gt;
&lt;br /&gt;
Please note that the burst analysis is done with 1 millisecond resolution by default. In our example, the router is connected with 1 GBit/s and it can receive more than the configured uplink bandwidth. This is shown in the display as an utilization of &amp;quot;&amp;gt;&amp;gt; 100%&amp;quot; and indicates that a burst that might not be able to be handled by this uplink.&lt;br /&gt;
&lt;br /&gt;
== Advantage for Mirror Port and Packet Brokers ==&lt;br /&gt;
&lt;br /&gt;
The MAC burst detection can be used for a specific end device ( a file server,... ) or for the gateway of an uplink ( router,... ). It allows to monitor links and end devices even in out-of-band installations.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3062</id>
		<title>Packet ring buffer</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3062"/>
		<updated>2020-10-09T11:13:13Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Packet ring buffer==&lt;br /&gt;
The ring buffer feature allows to create a buffer of fixed size on an external storage device to which all processed packets will be recorded. &lt;br /&gt;
If the fixed size buffer is full then the oldest packets in the buffer will be replaced with new packets in a round-robin fashion. &lt;br /&gt;
If the feature is not enabled, a button titled &#039;&#039;&#039;Create ring buffer&#039;&#039;&#039; is visible. &lt;br /&gt;
Upon clicking on it a dialogue will be displayed and allows you to specify the size of the ring buffer. &lt;br /&gt;
It must be ensured that enough space is available on the external storage device. &lt;br /&gt;
As soon as the ring buffer has been created, statistics about the ring buffer will be displayed instead of the button:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer1.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
* Timestamp of oldest packet: The timestamp of the oldest packet in the ring buffer.&lt;br /&gt;
&lt;br /&gt;
* Total size: The total size of the ring buffer on the external storage device. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than zero replication, an adjusted value is displayed to reflect the redundant copies of packet data. &lt;br /&gt;
:The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
&lt;br /&gt;
* Used size: The currently used amount of memory in the capture buffer. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than zero replication, an adjusted value is displayed to reflect the redundant copies of packet data. The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
* Overall bytes captured since start: The amount of captured bytes since system start. &lt;br /&gt;
:This may be smaller than the used size if the system has been restarted. And it may be larger than the used size in case the ring buffer is full. &lt;br /&gt;
:The history graph shows the captured traffic of the last minute or in the selected interval (if set).&lt;br /&gt;
* Bytes dropped since start: The traffic which was processed but could not be written to the ring buffer since the start of processing. &lt;br /&gt;
:This is usually an indicator that writes to the external storage device were not fast enough.  The history graph shows the drops over time.&lt;br /&gt;
* Bytes discarded due to snapshot length rules since start: The traffic which matched the snapshot length rules criteria and was not written to the ring buffer. &lt;br /&gt;
:The history graph shows discarding over time.&lt;br /&gt;
* Data in flight: The amount of data which is currently stored in the queue that holds processed packets before they are written to the packet ring buffer. &lt;br /&gt;
:If larger bursts of traffic need to be stored in this queue, the size can be modified in the capture module settings.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer2.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
When the ring buffer is full and old packets are deleted, the graphs will show the time range with no data with a dark grey background colour. &lt;br /&gt;
The time range before start of the ring buffer will be visualized in the same way.&lt;br /&gt;
When the ring buffer is running, the behaviour of the pcap capture buttons throughout the system changes: if the user interface is in live mode and a capture is started, a dialogue will appear asking you to specify from how far back in time the capture should start. &lt;br /&gt;
This way it is possible to e.g. capture the traffic of an IP address starting from an hour ago. &lt;br /&gt;
The capture will also continue with live traffic. &lt;br /&gt;
If the user interface is in &#039;&#039;&#039;back-in-time&#039;&#039;&#039; mode (a timespan from the past is selected) starting a capture will produce a dialogue asking to confirm that the capture will cover exactly the timespan selected. &lt;br /&gt;
The capture will automatically stop after the selected timespan has been processed. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer3.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Cluster ring buffer ==== &lt;br /&gt;
The cluster ring buffer feature allows you to use multiple whole disks in parallel for a single packet ring buffer. &lt;br /&gt;
It also allows you to optionally write redundant copies of packets to multiple disks to provide fault tolerance in case of a disk failure.&lt;br /&gt;
&lt;br /&gt;
It is also possible to create multiple cluster packet ring buffers that&lt;br /&gt;
run in parallel. To enable multiple cluster packet ring buffers, the&lt;br /&gt;
option `The maximum number of concurrent packet ring buffers` in the&lt;br /&gt;
capture module options can be set to the required number.&lt;br /&gt;
&lt;br /&gt;
When clicking the &#039;&#039;&#039;Create cluster ring buffer&#039;&#039;&#039; button, an empty cluster ring buffer will be created and the &#039;&#039;&#039;Cluster configuration&#039;&#039;&#039; tab on the now visible packet ring buffer statistics page becomes available. &lt;br /&gt;
&lt;br /&gt;
If multiple cluster packet ring buffers are used, the page will show&lt;br /&gt;
a number of buttons at the top to switch between the different clusters.&lt;br /&gt;
Each cluster has its own statistics and configuration.&lt;br /&gt;
&lt;br /&gt;
In the Cluster configuration tab you can configure the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; at the very top. &lt;br /&gt;
This level controls how many redundant copies of each packet are written. &lt;br /&gt;
No replication means that only a single copy of each packet is written and provides no redundancy. &lt;br /&gt;
This level gives the highest write bandwidth for a given number of disks; single replication means that one additional copy of each packet is written to some other disk and thus reduces the total write performance for a given number of disks to half the performance of no replication. &lt;br /&gt;
Double replication and triple replication writes two and three additional copies of each packet respectively. &lt;br /&gt;
Note that for each level to work there must be at least the number of replications + 1 disks available in the cluster.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster3.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Below the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; setting is the list of all disks available for use in the cluster. &lt;br /&gt;
The following columns are displayed in the list:&lt;br /&gt;
* Disk: A description of the disk and its capacity.&lt;br /&gt;
* Enclosure: If the disk is part of a multi-disk enclosure this column will show the enclosure number along with the slot number.&lt;br /&gt;
* Status: If the disk has been added to the cluster this column will display the current status as &#039;&#039;&#039;ok&#039;&#039;&#039; or &#039;&#039;&#039;failed&#039;&#039;&#039;. If multiple cluster packet ring buffers are used this will also show if the disk is active in another cluster.&lt;br /&gt;
* Locator: For disks in a multi-disk enclosure the button displayed in this column allows to turn the slot locator LED on and off. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
In the last unlabelled column, three buttons are displayed which have the following functionality:&lt;br /&gt;
* Add to cluster: Add a fresh disk to the cluster. &lt;br /&gt;
:The disk will be formatted and added as empty storage to the cluster. All previous data on the disk is lost.&lt;br /&gt;
* Resume in cluster: If the disk was previously part of a cluster it can be resumed. &lt;br /&gt;
:The data on that disk is now part of the packet ring buffer.&lt;br /&gt;
* Remove from cluster: Remove the disk from the ring buffer. &lt;br /&gt;
:The data stored on that disk is no longer part of the packet ring buffer but the data is not removed from the disk. It can be resumed in the cluster at a later time.&lt;br /&gt;
&lt;br /&gt;
:If a disk is missing because it was e.g. removed from the enclosure, it will be displayed in a separate list with much of the information as in the list described above but only one button with the option to remove it from the cluster packet ring buffer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster4.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Packet ring buffer snapshot length filter ====&lt;br /&gt;
Rules can be configured to control the snapshot length of each packet which will be stored in the packet ring buffer. &lt;br /&gt;
These rules can also be used to prevent certain packets from being stored in the packet ring buffer. &lt;br /&gt;
This allows you to fine tune how much packet data needs to be written to the packet ring buffer. &lt;br /&gt;
The information about the original length of a packet will still be available in captures except when the packet was not written to the packet ring buffer at all (e.g. due to a &#039;&#039;&#039;discard&#039;&#039;&#039; rule). &lt;br /&gt;
&lt;br /&gt;
These rules can be created, edited, deleted, moved up and moved down in the rules list by using the respective buttons.&lt;br /&gt;
&lt;br /&gt;
Evaluation of the rules takes place in the order of the rules as displayed in the rules list from top to bottom. &lt;br /&gt;
The first rule that matches for a given packet will be applied and no further rules will be evaluated for that packet. &lt;br /&gt;
This means that the most generic rule should be at the bottom of the list (like e.g. ‘all packets will be discarded’) and more specific rules should be higher up in the list (like e.g ‘packets with an IP matching 192.168.1.0/24 will be fully captured’).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
When creating a snapshot length filter rule, a dialogue is displayed and allows the following options:&lt;br /&gt;
* Rule condition: Specify which packets to match.&lt;br /&gt;
&lt;br /&gt;
:The input field below allows entering the corresponding value.&lt;br /&gt;
&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Rule condition&lt;br /&gt;
! description&lt;br /&gt;
|-&lt;br /&gt;
| All packets&lt;br /&gt;
| everything&lt;br /&gt;
|-&lt;br /&gt;
| MAC address&lt;br /&gt;
| source or destination MAC address&lt;br /&gt;
|-&lt;br /&gt;
| IP address&lt;br /&gt;
| source or destination IP address or subnet&lt;br /&gt;
|-&lt;br /&gt;
| TCP port&lt;br /&gt;
| the source or destination TCP port&lt;br /&gt;
|-&lt;br /&gt;
| UDP port&lt;br /&gt;
| the source or destination UDP port&lt;br /&gt;
|-&lt;br /&gt;
| Layer 7 protocol&lt;br /&gt;
| the selected Layer 7 protocol&lt;br /&gt;
|-&lt;br /&gt;
| outer VLAN tag&lt;br /&gt;
| the most outer VLAN tag (directly after Ethernet header) &lt;br /&gt;
|-&lt;br /&gt;
| interface&lt;br /&gt;
| the ingress interface the packet originated from&lt;br /&gt;
|-&lt;br /&gt;
| SIP phone number&lt;br /&gt;
|&lt;br /&gt;
The number matches part of the &#039;From:&#039; or &#039;To:&#039; entry in a SIP INVITE packet.&lt;br /&gt;
* only the part between &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;lt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; and &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;gt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; of the From/To line is tested.&lt;br /&gt;
* value &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; will match &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller1&amp;quot; &amp;lt;sip:234&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;, but also &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller2&amp;quot; &amp;lt;sip:12345@test&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;&lt;br /&gt;
* to match from the start, use &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;sip:234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Correlating SIP packets for the same Call-ID will match.&lt;br /&gt;
&lt;br /&gt;
The RTP packets correlated to this SIP call will also match.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
| virtual link group&lt;br /&gt;
| the virtual link group the packet belongs to&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Negate: Controls comparison of the rule condition to the value. If this is off, the value must match. &lt;br /&gt;
:If this is on, the value must not match.&lt;br /&gt;
* Action: What shall be done with the matching packets.&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Action !! Description&lt;br /&gt;
|-&lt;br /&gt;
| Snapshot length&lt;br /&gt;
| The packet is captured with a max length as specified in the input field below. If the packet is larger, the remaining bytes will be discarded.&lt;br /&gt;
|-&lt;br /&gt;
| Discard&lt;br /&gt;
| Discard the whole packet.&lt;br /&gt;
|-&lt;br /&gt;
| Full&lt;br /&gt;
| The entire packet is captured.&lt;br /&gt;
|-&lt;br /&gt;
| Header + data&lt;br /&gt;
|&lt;br /&gt;
Capture just certain parts of the packet.&lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 header&#039;&#039;&#039;, Layer 2 and Layer 3 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 header&#039;&#039;&#039;, Layer 2, 3 and 4 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 + L7 data&#039;&#039;&#039;, an input field is shown where the length of Layer 7 data can be configured.  In this case Layers 2, 3 and 4 are stored together with the specified amount of Layer 7 data.&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Analyzing the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is activated, it is possible to restart the packet processing core and analyze all packets contained in the packet ring buffer. &lt;br /&gt;
When the Analyze packet ring buffer button is pressed, a dialogue will appear which allows you to choose the time range of the packet ring buffer which is to be replayed. &lt;br /&gt;
After confirming this dialogue, the Network Multimeter will reset all statistics and start analyzing the contents of the packet ring buffer. &lt;br /&gt;
Progress, statistics and the option to resume normal operation will appear on the Packet ring buffer page.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== Extracting the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is active, the entire contents can be extracted by capturing the complete timespan that is contained within. &lt;br /&gt;
For convenience, a button labelled Extract packet ring buffer is available that opens the capture dialogue with the start time and end time set to the appropriate values.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3061</id>
		<title>Packet ring buffer</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3061"/>
		<updated>2020-10-09T10:27:37Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* Packet ring buffer snapshot length filter */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Packet ring buffer==&lt;br /&gt;
The ring buffer feature allows to create a buffer of fixed size on an external storage device to which all processed packets will be recorded. &lt;br /&gt;
If the fixed size buffer is full then the oldest packets in the buffer will be replaced with new packets in a round-robin fashion. &lt;br /&gt;
If the feature is not enabled, a button titled &#039;&#039;&#039;Create ring buffer&#039;&#039;&#039; is visible. &lt;br /&gt;
Upon clicking on it a dialogue will be displayed and allows you to specify the size of the ring buffer. &lt;br /&gt;
It must be ensured that enough space is available on the external storage device. &lt;br /&gt;
As soon as the ring buffer has been created, statistics about the ring buffer will be displayed instead of the button:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer1.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
* Timestamp of oldest packet: The timestamp of the oldest packet in the ring buffer.&lt;br /&gt;
&lt;br /&gt;
* Total size: The total size of the ring buffer on the external storage device. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication, an adjusted value is displayed to reflect the redundant copies of packet data. &lt;br /&gt;
:The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
&lt;br /&gt;
* Used size: The currently used amount of memory in the capture buffer. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication, an adjusted value is displayed to reflect the redundant copies of packet data. The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
* Overall bytes captured since start: The amount of captured bytes since system start. &lt;br /&gt;
:This may be smaller than the used size if the system has been restarted. And it may be larger than the used size in case the ring buffer is full. &lt;br /&gt;
:The history graph shows the captured traffic of the last minute or in the selected interval (if set).&lt;br /&gt;
* Bytes dropped since start: The traffic which was processed but could not be written to the ring buffer since the start of processing. &lt;br /&gt;
:This is usually an indicator that writes to the external storage device were not fast enough.  The history graph shows the drops over time.&lt;br /&gt;
* Bytes discarded due to snapshot length rules since start: The traffic which matched the snapshot length rules criteria and was not written to the ring buffer. &lt;br /&gt;
:The history graph shows discarding over time.&lt;br /&gt;
* Data in flight: The amount of data which is currently stored in the queue that holds processed packets before they are written to the packet ring buffer. &lt;br /&gt;
:If larger bursts of traffic need to be stored in this queue, the size can be modified in the capture module settings.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer2.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
When the ring buffer is full and old packets are deleted, the graphs will show the time range with no data with a dark grey background colour. &lt;br /&gt;
The time range before start of the ring buffer will be visualized in the same way.&lt;br /&gt;
When the ring buffer is running, the behaviour of the pcap capture buttons throughout the system changes: if the user interface is in live mode and a capture is started, a dialogue will appear asking you to specify from how far back in time the capture should start. &lt;br /&gt;
This way it is possible to e.g. capture the traffic of an IP address starting from an hour ago. &lt;br /&gt;
The capture will also continue with live traffic. &lt;br /&gt;
If the user interface is in &#039;&#039;&#039;back-in-time&#039;&#039;&#039; mode (a timespan from the past is selected) starting a capture will produce a dialogue asking to confirm that the capture will cover exactly the timespan selected. &lt;br /&gt;
The capture will automatically stop after the selected timespan has been processed. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer3.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Cluster ring buffer ==== &lt;br /&gt;
The cluster ring buffer feature allows you to use multiple whole disks in parallel for a single packet ring buffer. &lt;br /&gt;
It also allows you to optionally write redundant copies of packets to multiple disks to provide fault tolerance in case of a disk failure.&lt;br /&gt;
&lt;br /&gt;
It is also possible to create multiple cluster packet ring buffers that&lt;br /&gt;
run in parallel. To enable multiple cluster packet ring buffers, the&lt;br /&gt;
option `The maximum number of concurrent packet ring buffers` in the&lt;br /&gt;
capture module options can be set to the required number.&lt;br /&gt;
&lt;br /&gt;
When clicking the &#039;&#039;&#039;Create cluster ring buffer&#039;&#039;&#039; button, an empty cluster ring buffer will be created and the &#039;&#039;&#039;Cluster configuration&#039;&#039;&#039; tab on the now visible packet ring buffer statistics page becomes available. &lt;br /&gt;
&lt;br /&gt;
If multiple cluster packet ring buffers are used, the page will show&lt;br /&gt;
a number of buttons at the top to switch between the different clusters.&lt;br /&gt;
Each cluster has its own statistics and configuration.&lt;br /&gt;
&lt;br /&gt;
In the Cluster configuration tab you can configure the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; at the very top. &lt;br /&gt;
This level controls how many redundant copies of each packet are written. &lt;br /&gt;
No replication means that only a single copy of each packet is written and provides no redundancy. &lt;br /&gt;
This level gives the highest write bandwidth for a given number of disks; single replication means that one additional copy of each packet is written to some other disk and thus reduces the total write performance for a given number of disks to half the performance of no replication. &lt;br /&gt;
Double replication and triple replication writes two and three additional copies of each packet respectively. &lt;br /&gt;
Note that for each level to work there must be at least the number of replications + 1 disks available in the cluster.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster3.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Below the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; setting is the list of all disks available for use in the cluster. &lt;br /&gt;
The following columns are displayed in the list:&lt;br /&gt;
* Disk: A description of the disk and its capacity.&lt;br /&gt;
* Enclosure: If the disk is part of a multi-disk enclosure this column will show the enclosure number along with the slot number.&lt;br /&gt;
* Status: If the disk has been added to the cluster this column will display the current status as &#039;&#039;&#039;ok&#039;&#039;&#039; or &#039;&#039;&#039;failed&#039;&#039;&#039;. If multiple cluster packet ring buffers are used this will also show if the disk is active in another cluster.&lt;br /&gt;
* Locator: For disks in a multi-disk enclosure the button displayed in this column allows to turn the slot locator LED on and off. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
In the last unlabelled column, three buttons are displayed which have the following functionality:&lt;br /&gt;
* Add to cluster: Add a fresh disk to the cluster. &lt;br /&gt;
:The disk will be formatted and added as empty storage to the cluster. All previous data on the disk is lost.&lt;br /&gt;
* Resume in cluster: If the disk was previously part of a cluster it can be resumed. &lt;br /&gt;
:The data on that disk is now part of the packet ring buffer.&lt;br /&gt;
* Remove from cluster: Remove the disk from the ring buffer. &lt;br /&gt;
:The data stored on that disk is no longer part of the packet ring buffer but the data is not removed from the disk. It can be resumed in the cluster at a later time.&lt;br /&gt;
&lt;br /&gt;
:If a disk is missing because it was e.g. removed from the enclosure, it will be displayed in a separate list with much of the information as in the list described above but only one button with the option to remove it from the cluster packet ring buffer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster4.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Packet ring buffer snapshot length filter ====&lt;br /&gt;
Rules can be configured to control the snapshot length of each packet which will be stored in the packet ring buffer. &lt;br /&gt;
These rules can also be used to prevent certain packets from being stored in the packet ring buffer. &lt;br /&gt;
This allows you to fine tune how much packet data needs to be written to the packet ring buffer. &lt;br /&gt;
The information about the original length of a packet will still be available in captures except when the packet was not written to the packet ring buffer at all (e.g. due to a &#039;&#039;&#039;discard&#039;&#039;&#039; rule). &lt;br /&gt;
&lt;br /&gt;
These rules can be created, edited, deleted, moved up and moved down in the rules list by using the respective buttons.&lt;br /&gt;
&lt;br /&gt;
Evaluation of the rules takes place in the order of the rules as displayed in the rules list from top to bottom. &lt;br /&gt;
The first rule that matches for a given packet will be applied and no further rules will be evaluated for that packet. &lt;br /&gt;
This means that the most generic rule should be at the bottom of the list (like e.g. ‘all packets will be discarded’) and more specific rules should be higher up in the list (like e.g ‘packets with an IP matching 192.168.1.0/24 will be fully captured’).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
When creating a snapshot length filter rule, a dialogue is displayed and allows the following options:&lt;br /&gt;
* Rule condition: Specify which packets to match.&lt;br /&gt;
&lt;br /&gt;
:The input field below allows entering the corresponding value.&lt;br /&gt;
&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Rule condition&lt;br /&gt;
! description&lt;br /&gt;
|-&lt;br /&gt;
| All packets&lt;br /&gt;
| everything&lt;br /&gt;
|-&lt;br /&gt;
| MAC address&lt;br /&gt;
| source or destination MAC address&lt;br /&gt;
|-&lt;br /&gt;
| IP address&lt;br /&gt;
| source or destination IP address or subnet&lt;br /&gt;
|-&lt;br /&gt;
| TCP port&lt;br /&gt;
| the source or destination TCP port&lt;br /&gt;
|-&lt;br /&gt;
| UDP port&lt;br /&gt;
| the source or destination UDP port&lt;br /&gt;
|-&lt;br /&gt;
| Layer 7 protocol&lt;br /&gt;
| the selected Layer 7 protocol&lt;br /&gt;
|-&lt;br /&gt;
| outer VLAN tag&lt;br /&gt;
| the most outer VLAN tag (directly after Ethernet header) &lt;br /&gt;
|-&lt;br /&gt;
| interface&lt;br /&gt;
| the ingress interface the packet originated from&lt;br /&gt;
|-&lt;br /&gt;
| SIP phone number&lt;br /&gt;
|&lt;br /&gt;
The number matches part of the &#039;From:&#039; or &#039;To:&#039; entry in a SIP INVITE packet.&lt;br /&gt;
* only the part between &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;lt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; and &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;gt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; of the From/To line is tested.&lt;br /&gt;
* value &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; will match &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller1&amp;quot; &amp;lt;sip:234&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;, but also &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller2&amp;quot; &amp;lt;sip:12345@test&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;&lt;br /&gt;
* to match from the start, use &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;sip:234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Correlating SIP packets for the same Call-ID will match.&lt;br /&gt;
&lt;br /&gt;
The RTP packets correlated to this SIP call will also match.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
| virtual link group&lt;br /&gt;
| the virtual link group the packet belongs to&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Negate: Controls comparison of the rule condition to the value. If this is off, the value must match. &lt;br /&gt;
:If this is on, the value must not match.&lt;br /&gt;
* Action: What shall be done with the matching packets.&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Action !! Description&lt;br /&gt;
|-&lt;br /&gt;
| Snapshot length&lt;br /&gt;
| The packet is captured with a max length as specified in the input field below. If the packet is larger, the remaining bytes will be discarded.&lt;br /&gt;
|-&lt;br /&gt;
| Discard&lt;br /&gt;
| Discard the whole packet.&lt;br /&gt;
|-&lt;br /&gt;
| Full&lt;br /&gt;
| The entire packet is captured.&lt;br /&gt;
|-&lt;br /&gt;
| Header + data&lt;br /&gt;
|&lt;br /&gt;
Capture just certain parts of the packet.&lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 header&#039;&#039;&#039;, Layer 2 and Layer 3 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 header&#039;&#039;&#039;, Layer 2, 3 and 4 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 + L7 data&#039;&#039;&#039;, an input field is shown where the length of Layer 7 data can be configured.  In this case Layers 2, 3 and 4 are stored together with the specified amount of Layer 7 data.&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Analyzing the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is activated, it is possible to restart the packet processing core and analyze all packets contained in the packet ring buffer. &lt;br /&gt;
When the Analyze packet ring buffer button is pressed, a dialogue will appear which allows you to choose the time range of the packet ring buffer which is to be replayed. &lt;br /&gt;
After confirming this dialogue, the Network Multimeter will reset all statistics and start analyzing the contents of the packet ring buffer. &lt;br /&gt;
Progress, statistics and the option to resume normal operation will appear on the Packet ring buffer page.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== Extracting the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is active, the entire contents can be extracted by capturing the complete timespan that is contained within. &lt;br /&gt;
For convenience, a button labelled Extract packet ring buffer is available that opens the capture dialogue with the start time and end time set to the appropriate values.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3060</id>
		<title>Packet ring buffer</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3060"/>
		<updated>2020-10-09T10:27:08Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* Packet ring buffer snapshot length filter */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Packet ring buffer==&lt;br /&gt;
The ring buffer feature allows to create a buffer of fixed size on an external storage device to which all processed packets will be recorded. &lt;br /&gt;
If the fixed size buffer is full then the oldest packets in the buffer will be replaced with new packets in a round-robin fashion. &lt;br /&gt;
If the feature is not enabled, a button titled &#039;&#039;&#039;Create ring buffer&#039;&#039;&#039; is visible. &lt;br /&gt;
Upon clicking on it a dialogue will be displayed and allows you to specify the size of the ring buffer. &lt;br /&gt;
It must be ensured that enough space is available on the external storage device. &lt;br /&gt;
As soon as the ring buffer has been created, statistics about the ring buffer will be displayed instead of the button:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer1.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
* Timestamp of oldest packet: The timestamp of the oldest packet in the ring buffer.&lt;br /&gt;
&lt;br /&gt;
* Total size: The total size of the ring buffer on the external storage device. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication, an adjusted value is displayed to reflect the redundant copies of packet data. &lt;br /&gt;
:The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
&lt;br /&gt;
* Used size: The currently used amount of memory in the capture buffer. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication, an adjusted value is displayed to reflect the redundant copies of packet data. The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
* Overall bytes captured since start: The amount of captured bytes since system start. &lt;br /&gt;
:This may be smaller than the used size if the system has been restarted. And it may be larger than the used size in case the ring buffer is full. &lt;br /&gt;
:The history graph shows the captured traffic of the last minute or in the selected interval (if set).&lt;br /&gt;
* Bytes dropped since start: The traffic which was processed but could not be written to the ring buffer since the start of processing. &lt;br /&gt;
:This is usually an indicator that writes to the external storage device were not fast enough.  The history graph shows the drops over time.&lt;br /&gt;
* Bytes discarded due to snapshot length rules since start: The traffic which matched the snapshot length rules criteria and was not written to the ring buffer. &lt;br /&gt;
:The history graph shows discarding over time.&lt;br /&gt;
* Data in flight: The amount of data which is currently stored in the queue that holds processed packets before they are written to the packet ring buffer. &lt;br /&gt;
:If larger bursts of traffic need to be stored in this queue, the size can be modified in the capture module settings.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer2.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
When the ring buffer is full and old packets are deleted, the graphs will show the time range with no data with a dark grey background colour. &lt;br /&gt;
The time range before start of the ring buffer will be visualized in the same way.&lt;br /&gt;
When the ring buffer is running, the behaviour of the pcap capture buttons throughout the system changes: if the user interface is in live mode and a capture is started, a dialogue will appear asking you to specify from how far back in time the capture should start. &lt;br /&gt;
This way it is possible to e.g. capture the traffic of an IP address starting from an hour ago. &lt;br /&gt;
The capture will also continue with live traffic. &lt;br /&gt;
If the user interface is in &#039;&#039;&#039;back-in-time&#039;&#039;&#039; mode (a timespan from the past is selected) starting a capture will produce a dialogue asking to confirm that the capture will cover exactly the timespan selected. &lt;br /&gt;
The capture will automatically stop after the selected timespan has been processed. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer3.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Cluster ring buffer ==== &lt;br /&gt;
The cluster ring buffer feature allows you to use multiple whole disks in parallel for a single packet ring buffer. &lt;br /&gt;
It also allows you to optionally write redundant copies of packets to multiple disks to provide fault tolerance in case of a disk failure.&lt;br /&gt;
&lt;br /&gt;
It is also possible to create multiple cluster packet ring buffers that&lt;br /&gt;
run in parallel. To enable multiple cluster packet ring buffers, the&lt;br /&gt;
option `The maximum number of concurrent packet ring buffers` in the&lt;br /&gt;
capture module options can be set to the required number.&lt;br /&gt;
&lt;br /&gt;
When clicking the &#039;&#039;&#039;Create cluster ring buffer&#039;&#039;&#039; button, an empty cluster ring buffer will be created and the &#039;&#039;&#039;Cluster configuration&#039;&#039;&#039; tab on the now visible packet ring buffer statistics page becomes available. &lt;br /&gt;
&lt;br /&gt;
If multiple cluster packet ring buffers are used, the page will show&lt;br /&gt;
a number of buttons at the top to switch between the different clusters.&lt;br /&gt;
Each cluster has its own statistics and configuration.&lt;br /&gt;
&lt;br /&gt;
In the Cluster configuration tab you can configure the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; at the very top. &lt;br /&gt;
This level controls how many redundant copies of each packet are written. &lt;br /&gt;
No replication means that only a single copy of each packet is written and provides no redundancy. &lt;br /&gt;
This level gives the highest write bandwidth for a given number of disks; single replication means that one additional copy of each packet is written to some other disk and thus reduces the total write performance for a given number of disks to half the performance of no replication. &lt;br /&gt;
Double replication and triple replication writes two and three additional copies of each packet respectively. &lt;br /&gt;
Note that for each level to work there must be at least the number of replications + 1 disks available in the cluster.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster3.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Below the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; setting is the list of all disks available for use in the cluster. &lt;br /&gt;
The following columns are displayed in the list:&lt;br /&gt;
* Disk: A description of the disk and its capacity.&lt;br /&gt;
* Enclosure: If the disk is part of a multi-disk enclosure this column will show the enclosure number along with the slot number.&lt;br /&gt;
* Status: If the disk has been added to the cluster this column will display the current status as &#039;&#039;&#039;ok&#039;&#039;&#039; or &#039;&#039;&#039;failed&#039;&#039;&#039;. If multiple cluster packet ring buffers are used this will also show if the disk is active in another cluster.&lt;br /&gt;
* Locator: For disks in a multi-disk enclosure the button displayed in this column allows to turn the slot locator LED on and off. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
In the last unlabelled column, three buttons are displayed which have the following functionality:&lt;br /&gt;
* Add to cluster: Add a fresh disk to the cluster. &lt;br /&gt;
:The disk will be formatted and added as empty storage to the cluster. All previous data on the disk is lost.&lt;br /&gt;
* Resume in cluster: If the disk was previously part of a cluster it can be resumed. &lt;br /&gt;
:The data on that disk is now part of the packet ring buffer.&lt;br /&gt;
* Remove from cluster: Remove the disk from the ring buffer. &lt;br /&gt;
:The data stored on that disk is no longer part of the packet ring buffer but the data is not removed from the disk. It can be resumed in the cluster at a later time.&lt;br /&gt;
&lt;br /&gt;
:If a disk is missing because it was e.g. removed from the enclosure, it will be displayed in a separate list with much of the information as in the list described above but only one button with the option to remove it from the cluster packet ring buffer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster4.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Packet ring buffer snapshot length filter ====&lt;br /&gt;
Rules can be configured to control the snapshot length of each packet which will be stored in the packet ring buffer. &lt;br /&gt;
These rules can also be used to prevent certain packets from being stored in the packet ring buffer. &lt;br /&gt;
This allows to fine tune how much packet data needs to be written to the packet ring buffer. &lt;br /&gt;
The information about the original length of a packet will still be available in captures except when the packet was not written to the packet ring buffer at all (e.g. due to a &#039;&#039;&#039;discard&#039;&#039;&#039; rule). &lt;br /&gt;
&lt;br /&gt;
These rules can be created, edited, deleted, moved up and moved down in the rules list by using the respective buttons.&lt;br /&gt;
&lt;br /&gt;
Evaluation of the rules takes place in the order of the rules as displayed in the rules list from top to bottom. &lt;br /&gt;
The first rule that matches for a given packet will be applied and no further rules will be evaluated for that packet. &lt;br /&gt;
This means that the most generic rule should be at the bottom of the list (like e.g. ‘all packets will be discarded’) and more specific rules should be higher up in the list (like e.g ‘packets with an IP matching 192.168.1.0/24 will be fully captured’).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
When creating a snapshot length filter rule, a dialogue is displayed and allows the following options:&lt;br /&gt;
* Rule condition: Specify which packets to match.&lt;br /&gt;
&lt;br /&gt;
:The input field below allows entering the corresponding value.&lt;br /&gt;
&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Rule condition&lt;br /&gt;
! description&lt;br /&gt;
|-&lt;br /&gt;
| All packets&lt;br /&gt;
| everything&lt;br /&gt;
|-&lt;br /&gt;
| MAC address&lt;br /&gt;
| source or destination MAC address&lt;br /&gt;
|-&lt;br /&gt;
| IP address&lt;br /&gt;
| source or destination IP address or subnet&lt;br /&gt;
|-&lt;br /&gt;
| TCP port&lt;br /&gt;
| the source or destination TCP port&lt;br /&gt;
|-&lt;br /&gt;
| UDP port&lt;br /&gt;
| the source or destination UDP port&lt;br /&gt;
|-&lt;br /&gt;
| Layer 7 protocol&lt;br /&gt;
| the selected Layer 7 protocol&lt;br /&gt;
|-&lt;br /&gt;
| outer VLAN tag&lt;br /&gt;
| the most outer VLAN tag (directly after Ethernet header) &lt;br /&gt;
|-&lt;br /&gt;
| interface&lt;br /&gt;
| the ingress interface the packet originated from&lt;br /&gt;
|-&lt;br /&gt;
| SIP phone number&lt;br /&gt;
|&lt;br /&gt;
The number matches part of the &#039;From:&#039; or &#039;To:&#039; entry in a SIP INVITE packet.&lt;br /&gt;
* only the part between &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;lt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; and &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;gt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; of the From/To line is tested.&lt;br /&gt;
* value &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; will match &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller1&amp;quot; &amp;lt;sip:234&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;, but also &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller2&amp;quot; &amp;lt;sip:12345@test&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;&lt;br /&gt;
* to match from the start, use &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;sip:234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Correlating SIP packets for the same Call-ID will match.&lt;br /&gt;
&lt;br /&gt;
The RTP packets correlated to this SIP call will also match.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
| virtual link group&lt;br /&gt;
| the virtual link group the packet belongs to&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Negate: Controls comparison of the rule condition to the value. If this is off, the value must match. &lt;br /&gt;
:If this is on, the value must not match.&lt;br /&gt;
* Action: What shall be done with the matching packets.&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Action !! Description&lt;br /&gt;
|-&lt;br /&gt;
| Snapshot length&lt;br /&gt;
| The packet is captured with a max length as specified in the input field below. If the packet is larger, the remaining bytes will be discarded.&lt;br /&gt;
|-&lt;br /&gt;
| Discard&lt;br /&gt;
| Discard the whole packet.&lt;br /&gt;
|-&lt;br /&gt;
| Full&lt;br /&gt;
| The entire packet is captured.&lt;br /&gt;
|-&lt;br /&gt;
| Header + data&lt;br /&gt;
|&lt;br /&gt;
Capture just certain parts of the packet.&lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 header&#039;&#039;&#039;, Layer 2 and Layer 3 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 header&#039;&#039;&#039;, Layer 2, 3 and 4 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 + L7 data&#039;&#039;&#039;, an input field is shown where the length of Layer 7 data can be configured.  In this case Layers 2, 3 and 4 are stored together with the specified amount of Layer 7 data.&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Analyzing the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is activated, it is possible to restart the packet processing core and analyze all packets contained in the packet ring buffer. &lt;br /&gt;
When the Analyze packet ring buffer button is pressed, a dialogue will appear which allows you to choose the time range of the packet ring buffer which is to be replayed. &lt;br /&gt;
After confirming this dialogue, the Network Multimeter will reset all statistics and start analyzing the contents of the packet ring buffer. &lt;br /&gt;
Progress, statistics and the option to resume normal operation will appear on the Packet ring buffer page.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== Extracting the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is active, the entire contents can be extracted by capturing the complete timespan that is contained within. &lt;br /&gt;
For convenience, a button labelled Extract packet ring buffer is available that opens the capture dialogue with the start time and end time set to the appropriate values.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3059</id>
		<title>Packet ring buffer</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3059"/>
		<updated>2020-10-09T10:26:20Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* Cluster ring buffer */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Packet ring buffer==&lt;br /&gt;
The ring buffer feature allows to create a buffer of fixed size on an external storage device to which all processed packets will be recorded. &lt;br /&gt;
If the fixed size buffer is full then the oldest packets in the buffer will be replaced with new packets in a round-robin fashion. &lt;br /&gt;
If the feature is not enabled, a button titled &#039;&#039;&#039;Create ring buffer&#039;&#039;&#039; is visible. &lt;br /&gt;
Upon clicking on it a dialogue will be displayed and allows you to specify the size of the ring buffer. &lt;br /&gt;
It must be ensured that enough space is available on the external storage device. &lt;br /&gt;
As soon as the ring buffer has been created, statistics about the ring buffer will be displayed instead of the button:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer1.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
* Timestamp of oldest packet: The timestamp of the oldest packet in the ring buffer.&lt;br /&gt;
&lt;br /&gt;
* Total size: The total size of the ring buffer on the external storage device. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication, an adjusted value is displayed to reflect the redundant copies of packet data. &lt;br /&gt;
:The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
&lt;br /&gt;
* Used size: The currently used amount of memory in the capture buffer. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication, an adjusted value is displayed to reflect the redundant copies of packet data. The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
* Overall bytes captured since start: The amount of captured bytes since system start. &lt;br /&gt;
:This may be smaller than the used size if the system has been restarted. And it may be larger than the used size in case the ring buffer is full. &lt;br /&gt;
:The history graph shows the captured traffic of the last minute or in the selected interval (if set).&lt;br /&gt;
* Bytes dropped since start: The traffic which was processed but could not be written to the ring buffer since the start of processing. &lt;br /&gt;
:This is usually an indicator that writes to the external storage device were not fast enough.  The history graph shows the drops over time.&lt;br /&gt;
* Bytes discarded due to snapshot length rules since start: The traffic which matched the snapshot length rules criteria and was not written to the ring buffer. &lt;br /&gt;
:The history graph shows discarding over time.&lt;br /&gt;
* Data in flight: The amount of data which is currently stored in the queue that holds processed packets before they are written to the packet ring buffer. &lt;br /&gt;
:If larger bursts of traffic need to be stored in this queue, the size can be modified in the capture module settings.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer2.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
When the ring buffer is full and old packets are deleted, the graphs will show the time range with no data with a dark grey background colour. &lt;br /&gt;
The time range before start of the ring buffer will be visualized in the same way.&lt;br /&gt;
When the ring buffer is running, the behaviour of the pcap capture buttons throughout the system changes: if the user interface is in live mode and a capture is started, a dialogue will appear asking you to specify from how far back in time the capture should start. &lt;br /&gt;
This way it is possible to e.g. capture the traffic of an IP address starting from an hour ago. &lt;br /&gt;
The capture will also continue with live traffic. &lt;br /&gt;
If the user interface is in &#039;&#039;&#039;back-in-time&#039;&#039;&#039; mode (a timespan from the past is selected) starting a capture will produce a dialogue asking to confirm that the capture will cover exactly the timespan selected. &lt;br /&gt;
The capture will automatically stop after the selected timespan has been processed. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer3.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Cluster ring buffer ==== &lt;br /&gt;
The cluster ring buffer feature allows you to use multiple whole disks in parallel for a single packet ring buffer. &lt;br /&gt;
It also allows you to optionally write redundant copies of packets to multiple disks to provide fault tolerance in case of a disk failure.&lt;br /&gt;
&lt;br /&gt;
It is also possible to create multiple cluster packet ring buffers that&lt;br /&gt;
run in parallel. To enable multiple cluster packet ring buffers, the&lt;br /&gt;
option `The maximum number of concurrent packet ring buffers` in the&lt;br /&gt;
capture module options can be set to the required number.&lt;br /&gt;
&lt;br /&gt;
When clicking the &#039;&#039;&#039;Create cluster ring buffer&#039;&#039;&#039; button, an empty cluster ring buffer will be created and the &#039;&#039;&#039;Cluster configuration&#039;&#039;&#039; tab on the now visible packet ring buffer statistics page becomes available. &lt;br /&gt;
&lt;br /&gt;
If multiple cluster packet ring buffers are used, the page will show&lt;br /&gt;
a number of buttons at the top to switch between the different clusters.&lt;br /&gt;
Each cluster has its own statistics and configuration.&lt;br /&gt;
&lt;br /&gt;
In the Cluster configuration tab you can configure the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; at the very top. &lt;br /&gt;
This level controls how many redundant copies of each packet are written. &lt;br /&gt;
No replication means that only a single copy of each packet is written and provides no redundancy. &lt;br /&gt;
This level gives the highest write bandwidth for a given number of disks; single replication means that one additional copy of each packet is written to some other disk and thus reduces the total write performance for a given number of disks to half the performance of no replication. &lt;br /&gt;
Double replication and triple replication writes two and three additional copies of each packet respectively. &lt;br /&gt;
Note that for each level to work there must be at least the number of replications + 1 disks available in the cluster.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster3.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Below the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; setting is the list of all disks available for use in the cluster. &lt;br /&gt;
The following columns are displayed in the list:&lt;br /&gt;
* Disk: A description of the disk and its capacity.&lt;br /&gt;
* Enclosure: If the disk is part of a multi-disk enclosure this column will show the enclosure number along with the slot number.&lt;br /&gt;
* Status: If the disk has been added to the cluster this column will display the current status as &#039;&#039;&#039;ok&#039;&#039;&#039; or &#039;&#039;&#039;failed&#039;&#039;&#039;. If multiple cluster packet ring buffers are used this will also show if the disk is active in another cluster.&lt;br /&gt;
* Locator: For disks in a multi-disk enclosure the button displayed in this column allows to turn the slot locator LED on and off. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
In the last unlabelled column, three buttons are displayed which have the following functionality:&lt;br /&gt;
* Add to cluster: Add a fresh disk to the cluster. &lt;br /&gt;
:The disk will be formatted and added as empty storage to the cluster. All previous data on the disk is lost.&lt;br /&gt;
* Resume in cluster: If the disk was previously part of a cluster it can be resumed. &lt;br /&gt;
:The data on that disk is now part of the packet ring buffer.&lt;br /&gt;
* Remove from cluster: Remove the disk from the ring buffer. &lt;br /&gt;
:The data stored on that disk is no longer part of the packet ring buffer but the data is not removed from the disk. It can be resumed in the cluster at a later time.&lt;br /&gt;
&lt;br /&gt;
:If a disk is missing because it was e.g. removed from the enclosure, it will be displayed in a separate list with much of the information as in the list described above but only one button with the option to remove it from the cluster packet ring buffer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster4.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Packet ring buffer snapshot length filter ====&lt;br /&gt;
Rules can be configured that control the snapshot length of each packet which will be stored in the packet ring buffer. &lt;br /&gt;
These rules can also be used to prevent certain packets from being stored in the packet ring buffer. &lt;br /&gt;
This allows to fine tune how much packet data needs to be written to the packet ring buffer. &lt;br /&gt;
The information about the original length of a packet will still be available in captures except when the packet was not written to the packet ring buffer at all (e.g. due to a &#039;&#039;&#039;discard&#039;&#039;&#039; rule). &lt;br /&gt;
&lt;br /&gt;
These rules can be created, edited, deleted, moved up and moved down in the rules list by using the respective buttons.&lt;br /&gt;
&lt;br /&gt;
Evaluation of the rules takes place in the order of the rules as displayed in the rules list from top to bottom. &lt;br /&gt;
The first rule that matches for a given packet will be applied and no further rules will be evaluated for that packet. &lt;br /&gt;
This means that the most generic rule should be at the bottom of the list (like e.g. ‘all packets will be discarded’) and more specific rules should be higher up in the list (like e.g ‘packets with an IP matching 192.168.1.0/24 will be fully captured’).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
When creating a snapshot length filter rule, a dialogue is displayed and allows the following options:&lt;br /&gt;
* Rule condition: Specify which packets to match.&lt;br /&gt;
&lt;br /&gt;
:The input field below allows entering the corresponding value.&lt;br /&gt;
&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Rule condition&lt;br /&gt;
! description&lt;br /&gt;
|-&lt;br /&gt;
| All packets&lt;br /&gt;
| everything&lt;br /&gt;
|-&lt;br /&gt;
| MAC address&lt;br /&gt;
| source or destination MAC address&lt;br /&gt;
|-&lt;br /&gt;
| IP address&lt;br /&gt;
| source or destination IP address or subnet&lt;br /&gt;
|-&lt;br /&gt;
| TCP port&lt;br /&gt;
| the source or destination TCP port&lt;br /&gt;
|-&lt;br /&gt;
| UDP port&lt;br /&gt;
| the source or destination UDP port&lt;br /&gt;
|-&lt;br /&gt;
| Layer 7 protocol&lt;br /&gt;
| the selected Layer 7 protocol&lt;br /&gt;
|-&lt;br /&gt;
| outer VLAN tag&lt;br /&gt;
| the most outer VLAN tag (directly after Ethernet header) &lt;br /&gt;
|-&lt;br /&gt;
| interface&lt;br /&gt;
| the ingress interface the packet originated from&lt;br /&gt;
|-&lt;br /&gt;
| SIP phone number&lt;br /&gt;
|&lt;br /&gt;
The number matches part of the &#039;From:&#039; or &#039;To:&#039; entry in a SIP INVITE packet.&lt;br /&gt;
* only the part between &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;lt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; and &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;gt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; of the From/To line is tested.&lt;br /&gt;
* value &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; will match &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller1&amp;quot; &amp;lt;sip:234&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;, but also &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller2&amp;quot; &amp;lt;sip:12345@test&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;&lt;br /&gt;
* to match from the start, use &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;sip:234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Correlating SIP packets for the same Call-ID will match.&lt;br /&gt;
&lt;br /&gt;
The RTP packets correlated to this SIP call will also match.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
| virtual link group&lt;br /&gt;
| the virtual link group the packet belongs to&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Negate: Controls comparison of the rule condition to the value. If this is off, the value must match. &lt;br /&gt;
:If this is on, the value must not match.&lt;br /&gt;
* Action: What shall be done with the matching packets.&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Action !! Description&lt;br /&gt;
|-&lt;br /&gt;
| Snapshot length&lt;br /&gt;
| The packet is captured with a max length as specified in the input field below. If the packet is larger, the remaining bytes will be discarded.&lt;br /&gt;
|-&lt;br /&gt;
| Discard&lt;br /&gt;
| Discard the whole packet.&lt;br /&gt;
|-&lt;br /&gt;
| Full&lt;br /&gt;
| The entire packet is captured.&lt;br /&gt;
|-&lt;br /&gt;
| Header + data&lt;br /&gt;
|&lt;br /&gt;
Capture just certain parts of the packet.&lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 header&#039;&#039;&#039;, Layer 2 and Layer 3 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 header&#039;&#039;&#039;, Layer 2, 3 and 4 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 + L7 data&#039;&#039;&#039;, an input field is shown where the length of Layer 7 data can be configured.  In this case Layers 2, 3 and 4 are stored together with the specified amount of Layer 7 data.&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Analyzing the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is activated, it is possible to restart the packet processing core and analyze all packets contained in the packet ring buffer. &lt;br /&gt;
When the Analyze packet ring buffer button is pressed, a dialogue will appear which allows you to choose the time range of the packet ring buffer which is to be replayed. &lt;br /&gt;
After confirming this dialogue, the Network Multimeter will reset all statistics and start analyzing the contents of the packet ring buffer. &lt;br /&gt;
Progress, statistics and the option to resume normal operation will appear on the Packet ring buffer page.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== Extracting the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is active, the entire contents can be extracted by capturing the complete timespan that is contained within. &lt;br /&gt;
For convenience, a button labelled Extract packet ring buffer is available that opens the capture dialogue with the start time and end time set to the appropriate values.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3058</id>
		<title>Packet ring buffer</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3058"/>
		<updated>2020-10-09T10:25:07Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* Cluster ring buffer */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Packet ring buffer==&lt;br /&gt;
The ring buffer feature allows to create a buffer of fixed size on an external storage device to which all processed packets will be recorded. &lt;br /&gt;
If the fixed size buffer is full then the oldest packets in the buffer will be replaced with new packets in a round-robin fashion. &lt;br /&gt;
If the feature is not enabled, a button titled &#039;&#039;&#039;Create ring buffer&#039;&#039;&#039; is visible. &lt;br /&gt;
Upon clicking on it a dialogue will be displayed and allows you to specify the size of the ring buffer. &lt;br /&gt;
It must be ensured that enough space is available on the external storage device. &lt;br /&gt;
As soon as the ring buffer has been created, statistics about the ring buffer will be displayed instead of the button:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer1.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
* Timestamp of oldest packet: The timestamp of the oldest packet in the ring buffer.&lt;br /&gt;
&lt;br /&gt;
* Total size: The total size of the ring buffer on the external storage device. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication, an adjusted value is displayed to reflect the redundant copies of packet data. &lt;br /&gt;
:The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
&lt;br /&gt;
* Used size: The currently used amount of memory in the capture buffer. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication, an adjusted value is displayed to reflect the redundant copies of packet data. The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
* Overall bytes captured since start: The amount of captured bytes since system start. &lt;br /&gt;
:This may be smaller than the used size if the system has been restarted. And it may be larger than the used size in case the ring buffer is full. &lt;br /&gt;
:The history graph shows the captured traffic of the last minute or in the selected interval (if set).&lt;br /&gt;
* Bytes dropped since start: The traffic which was processed but could not be written to the ring buffer since the start of processing. &lt;br /&gt;
:This is usually an indicator that writes to the external storage device were not fast enough.  The history graph shows the drops over time.&lt;br /&gt;
* Bytes discarded due to snapshot length rules since start: The traffic which matched the snapshot length rules criteria and was not written to the ring buffer. &lt;br /&gt;
:The history graph shows discarding over time.&lt;br /&gt;
* Data in flight: The amount of data which is currently stored in the queue that holds processed packets before they are written to the packet ring buffer. &lt;br /&gt;
:If larger bursts of traffic need to be stored in this queue, the size can be modified in the capture module settings.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer2.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
When the ring buffer is full and old packets are deleted, the graphs will show the time range with no data with a dark grey background colour. &lt;br /&gt;
The time range before start of the ring buffer will be visualized in the same way.&lt;br /&gt;
When the ring buffer is running, the behaviour of the pcap capture buttons throughout the system changes: if the user interface is in live mode and a capture is started, a dialogue will appear asking you to specify from how far back in time the capture should start. &lt;br /&gt;
This way it is possible to e.g. capture the traffic of an IP address starting from an hour ago. &lt;br /&gt;
The capture will also continue with live traffic. &lt;br /&gt;
If the user interface is in &#039;&#039;&#039;back-in-time&#039;&#039;&#039; mode (a timespan from the past is selected) starting a capture will produce a dialogue asking to confirm that the capture will cover exactly the timespan selected. &lt;br /&gt;
The capture will automatically stop after the selected timespan has been processed. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer3.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Cluster ring buffer ==== &lt;br /&gt;
The cluster ring buffer feature allows you to use multiple whole disks in parallel for a single packet ring buffer. &lt;br /&gt;
It also allows you to optionally write redundant copies of packets to multiple disks to provide fault tolerance in case of a disk failure.&lt;br /&gt;
&lt;br /&gt;
It is also possible to create multiple cluster packet ring buffers that&lt;br /&gt;
run in parallel. To enable multiple cluster packet ring buffers, the&lt;br /&gt;
option `The maximum number of concurrent packet ring buffers` in the&lt;br /&gt;
capture module options can be set to the required number.&lt;br /&gt;
&lt;br /&gt;
When clicking the &#039;&#039;&#039;Create cluster ring buffer&#039;&#039;&#039; button, an empty cluster ring buffer will be created and the &#039;&#039;&#039;Cluster configuration&#039;&#039;&#039; tab on the now visible packet ring buffer statistics page becomes available. &lt;br /&gt;
&lt;br /&gt;
If multiple cluster packet ring buffers are used, the page will show&lt;br /&gt;
a number of buttons at the top to switch between the different clusters.&lt;br /&gt;
Each cluster has its own statistics and configuration.&lt;br /&gt;
&lt;br /&gt;
In the Cluster configuration tab you can configure the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; at the very top. &lt;br /&gt;
This level controls how many redundant copies of each packet are written. &lt;br /&gt;
No replication means that only a single copy of each packet is written and provides no redundancy. &lt;br /&gt;
This level gives the highest write bandwidth for a given number of disks; single replication means that one additional copy of each packet is written to some other disk and thus reduces the total write performance for a given number of disks to half the performance of no replication. &lt;br /&gt;
Double replication and triple replication writes two and three additional copies of each packet respectively. &lt;br /&gt;
Note that for each level to work there must be at least the number of replications + 1 disks available in the cluster.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster3.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Below the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; setting is the list of all disks available for use in the cluster. &lt;br /&gt;
The following columns are displayed in the list:&lt;br /&gt;
* Disk: A description of the disk and its capacity.&lt;br /&gt;
* Enclosure: If the disk is part of a multi-disk enclosure this column will show the enclosure number along with the slot number.&lt;br /&gt;
* Status: If the disk has been added to the cluster this column will display the current status as &#039;&#039;&#039;ok&#039;&#039;&#039; or &#039;&#039;&#039;failed&#039;&#039;&#039;. If multiple cluster packet ring buffers are used this will also show if the disk is active in another cluster.&lt;br /&gt;
* Locator: For disks in a multi-disk enclosure the button displayed in this column allows to turn the slot locator LED on and off. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
In the last unlabelled column, three buttons are displayed which have the following functionality:&lt;br /&gt;
* Add to cluster: Add a fresh disk to the cluster. &lt;br /&gt;
:The disk will be formatted and added as empty storage to the cluster. All previous data on the disk is lost.&lt;br /&gt;
* Resume in cluster: If the disk was previously part of a cluster it can be resumed. &lt;br /&gt;
:The data on that disk is now part of the packet ring buffer.&lt;br /&gt;
* Remove from cluster: Remove the disk from the ring buffer. &lt;br /&gt;
:The data stored on that disk is no longer not part of the packet ring buffer but the data is not removed from the disk. It can be resumed in the cluster at a later time.&lt;br /&gt;
&lt;br /&gt;
:If a disk is missing because it was e.g. removed from the enclosure, it will be displayed in a separate list with much of the information as in the list described above but only one button with the option to remove it from the cluster packet ring buffer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster4.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Packet ring buffer snapshot length filter ====&lt;br /&gt;
Rules can be configured that control the snapshot length of each packet which will be stored in the packet ring buffer. &lt;br /&gt;
These rules can also be used to prevent certain packets from being stored in the packet ring buffer. &lt;br /&gt;
This allows to fine tune how much packet data needs to be written to the packet ring buffer. &lt;br /&gt;
The information about the original length of a packet will still be available in captures except when the packet was not written to the packet ring buffer at all (e.g. due to a &#039;&#039;&#039;discard&#039;&#039;&#039; rule). &lt;br /&gt;
&lt;br /&gt;
These rules can be created, edited, deleted, moved up and moved down in the rules list by using the respective buttons.&lt;br /&gt;
&lt;br /&gt;
Evaluation of the rules takes place in the order of the rules as displayed in the rules list from top to bottom. &lt;br /&gt;
The first rule that matches for a given packet will be applied and no further rules will be evaluated for that packet. &lt;br /&gt;
This means that the most generic rule should be at the bottom of the list (like e.g. ‘all packets will be discarded’) and more specific rules should be higher up in the list (like e.g ‘packets with an IP matching 192.168.1.0/24 will be fully captured’).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
When creating a snapshot length filter rule, a dialogue is displayed and allows the following options:&lt;br /&gt;
* Rule condition: Specify which packets to match.&lt;br /&gt;
&lt;br /&gt;
:The input field below allows entering the corresponding value.&lt;br /&gt;
&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Rule condition&lt;br /&gt;
! description&lt;br /&gt;
|-&lt;br /&gt;
| All packets&lt;br /&gt;
| everything&lt;br /&gt;
|-&lt;br /&gt;
| MAC address&lt;br /&gt;
| source or destination MAC address&lt;br /&gt;
|-&lt;br /&gt;
| IP address&lt;br /&gt;
| source or destination IP address or subnet&lt;br /&gt;
|-&lt;br /&gt;
| TCP port&lt;br /&gt;
| the source or destination TCP port&lt;br /&gt;
|-&lt;br /&gt;
| UDP port&lt;br /&gt;
| the source or destination UDP port&lt;br /&gt;
|-&lt;br /&gt;
| Layer 7 protocol&lt;br /&gt;
| the selected Layer 7 protocol&lt;br /&gt;
|-&lt;br /&gt;
| outer VLAN tag&lt;br /&gt;
| the most outer VLAN tag (directly after Ethernet header) &lt;br /&gt;
|-&lt;br /&gt;
| interface&lt;br /&gt;
| the ingress interface the packet originated from&lt;br /&gt;
|-&lt;br /&gt;
| SIP phone number&lt;br /&gt;
|&lt;br /&gt;
The number matches part of the &#039;From:&#039; or &#039;To:&#039; entry in a SIP INVITE packet.&lt;br /&gt;
* only the part between &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;lt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; and &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;gt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; of the From/To line is tested.&lt;br /&gt;
* value &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; will match &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller1&amp;quot; &amp;lt;sip:234&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;, but also &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller2&amp;quot; &amp;lt;sip:12345@test&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;&lt;br /&gt;
* to match from the start, use &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;sip:234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Correlating SIP packets for the same Call-ID will match.&lt;br /&gt;
&lt;br /&gt;
The RTP packets correlated to this SIP call will also match.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
| virtual link group&lt;br /&gt;
| the virtual link group the packet belongs to&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Negate: Controls comparison of the rule condition to the value. If this is off, the value must match. &lt;br /&gt;
:If this is on, the value must not match.&lt;br /&gt;
* Action: What shall be done with the matching packets.&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Action !! Description&lt;br /&gt;
|-&lt;br /&gt;
| Snapshot length&lt;br /&gt;
| The packet is captured with a max length as specified in the input field below. If the packet is larger, the remaining bytes will be discarded.&lt;br /&gt;
|-&lt;br /&gt;
| Discard&lt;br /&gt;
| Discard the whole packet.&lt;br /&gt;
|-&lt;br /&gt;
| Full&lt;br /&gt;
| The entire packet is captured.&lt;br /&gt;
|-&lt;br /&gt;
| Header + data&lt;br /&gt;
|&lt;br /&gt;
Capture just certain parts of the packet.&lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 header&#039;&#039;&#039;, Layer 2 and Layer 3 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 header&#039;&#039;&#039;, Layer 2, 3 and 4 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 + L7 data&#039;&#039;&#039;, an input field is shown where the length of Layer 7 data can be configured.  In this case Layers 2, 3 and 4 are stored together with the specified amount of Layer 7 data.&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Analyzing the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is activated, it is possible to restart the packet processing core and analyze all packets contained in the packet ring buffer. &lt;br /&gt;
When the Analyze packet ring buffer button is pressed, a dialogue will appear which allows you to choose the time range of the packet ring buffer which is to be replayed. &lt;br /&gt;
After confirming this dialogue, the Network Multimeter will reset all statistics and start analyzing the contents of the packet ring buffer. &lt;br /&gt;
Progress, statistics and the option to resume normal operation will appear on the Packet ring buffer page.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== Extracting the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is active, the entire contents can be extracted by capturing the complete timespan that is contained within. &lt;br /&gt;
For convenience, a button labelled Extract packet ring buffer is available that opens the capture dialogue with the start time and end time set to the appropriate values.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3057</id>
		<title>Packet ring buffer</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3057"/>
		<updated>2020-10-09T10:24:02Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* Cluster ring buffer */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Packet ring buffer==&lt;br /&gt;
The ring buffer feature allows to create a buffer of fixed size on an external storage device to which all processed packets will be recorded. &lt;br /&gt;
If the fixed size buffer is full then the oldest packets in the buffer will be replaced with new packets in a round-robin fashion. &lt;br /&gt;
If the feature is not enabled, a button titled &#039;&#039;&#039;Create ring buffer&#039;&#039;&#039; is visible. &lt;br /&gt;
Upon clicking on it a dialogue will be displayed and allows you to specify the size of the ring buffer. &lt;br /&gt;
It must be ensured that enough space is available on the external storage device. &lt;br /&gt;
As soon as the ring buffer has been created, statistics about the ring buffer will be displayed instead of the button:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer1.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
* Timestamp of oldest packet: The timestamp of the oldest packet in the ring buffer.&lt;br /&gt;
&lt;br /&gt;
* Total size: The total size of the ring buffer on the external storage device. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication, an adjusted value is displayed to reflect the redundant copies of packet data. &lt;br /&gt;
:The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
&lt;br /&gt;
* Used size: The currently used amount of memory in the capture buffer. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication, an adjusted value is displayed to reflect the redundant copies of packet data. The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
* Overall bytes captured since start: The amount of captured bytes since system start. &lt;br /&gt;
:This may be smaller than the used size if the system has been restarted. And it may be larger than the used size in case the ring buffer is full. &lt;br /&gt;
:The history graph shows the captured traffic of the last minute or in the selected interval (if set).&lt;br /&gt;
* Bytes dropped since start: The traffic which was processed but could not be written to the ring buffer since the start of processing. &lt;br /&gt;
:This is usually an indicator that writes to the external storage device were not fast enough.  The history graph shows the drops over time.&lt;br /&gt;
* Bytes discarded due to snapshot length rules since start: The traffic which matched the snapshot length rules criteria and was not written to the ring buffer. &lt;br /&gt;
:The history graph shows discarding over time.&lt;br /&gt;
* Data in flight: The amount of data which is currently stored in the queue that holds processed packets before they are written to the packet ring buffer. &lt;br /&gt;
:If larger bursts of traffic need to be stored in this queue, the size can be modified in the capture module settings.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer2.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
When the ring buffer is full and old packets are deleted, the graphs will show the time range with no data with a dark grey background colour. &lt;br /&gt;
The time range before start of the ring buffer will be visualized in the same way.&lt;br /&gt;
When the ring buffer is running, the behaviour of the pcap capture buttons throughout the system changes: if the user interface is in live mode and a capture is started, a dialogue will appear asking you to specify from how far back in time the capture should start. &lt;br /&gt;
This way it is possible to e.g. capture the traffic of an IP address starting from an hour ago. &lt;br /&gt;
The capture will also continue with live traffic. &lt;br /&gt;
If the user interface is in &#039;&#039;&#039;back-in-time&#039;&#039;&#039; mode (a timespan from the past is selected) starting a capture will produce a dialogue asking to confirm that the capture will cover exactly the timespan selected. &lt;br /&gt;
The capture will automatically stop after the selected timespan has been processed. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer3.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Cluster ring buffer ==== &lt;br /&gt;
The cluster ring buffer feature allows you to use multiple whole disks in parallel for a single packet ring buffer. &lt;br /&gt;
It also allows you to optionally write redundant copies of packets to multiple disks to provide fault tolerance in case of a disk failure.&lt;br /&gt;
&lt;br /&gt;
It is also possible to create multiple cluster packet ring buffers that&lt;br /&gt;
run in parallel. To enable multiple cluster packet ring buffers, the&lt;br /&gt;
option `The maximum number of concurrent packet ring buffers` in the&lt;br /&gt;
capture module options can be set to the required number.&lt;br /&gt;
&lt;br /&gt;
When clicking the &#039;&#039;&#039;Create cluster ring buffer&#039;&#039;&#039; button, an empty cluster ring buffer will be created and the &#039;&#039;&#039;Cluster configuration&#039;&#039;&#039; tab on the now visible packet ring buffer statistics page becomes available. &lt;br /&gt;
&lt;br /&gt;
If multiple cluster packet ring buffers are used, the page will show&lt;br /&gt;
a number of buttons at the top to switch between the different clusters.&lt;br /&gt;
Each cluster has its own statistics and configuration.&lt;br /&gt;
&lt;br /&gt;
In the Cluster configuration tab you can configure the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; at the very top. &lt;br /&gt;
This level controls how many redundant copies of each packet are written. &lt;br /&gt;
No replication means that only a single copy of each packet is written and provides no redundancy. &lt;br /&gt;
This level gives the highest write bandwidth for a given number of disks; single replication means that one additional copy of each packet is written to some other disk and thus reduces the total write performance for a given number of disks to half the performance of no replication. &lt;br /&gt;
Double replication and triple replication write two and three additional copies of each packet respectively. &lt;br /&gt;
Note that for each level to work there must be at least the number of replications + 1 disks available in the cluster.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster3.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Below the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; setting is the list of all disks available for use in the cluster. &lt;br /&gt;
The following columns are displayed in the list:&lt;br /&gt;
* Disk: A description of the disk and its capacity.&lt;br /&gt;
* Enclosure: If the disk is part of a multi-disk enclosure this column will show the enclosure number along with the slot number.&lt;br /&gt;
* Status: If the disk has been added to the cluster this column will display the current status as &#039;&#039;&#039;ok&#039;&#039;&#039; or &#039;&#039;&#039;failed&#039;&#039;&#039;. If multiple cluster packet ring buffers are used this will also show if the disk is active in another cluster.&lt;br /&gt;
* Locator: For disks in a multi-disk enclosure the button displayed in this column allows to turn the slot locator LED on and off. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
In the last unlabelled column, three buttons are displayed which have the following functionality:&lt;br /&gt;
* Add to cluster: Add a fresh disk to the cluster. &lt;br /&gt;
:The disk will be formatted and added as empty storage to the cluster. All previous data on the disk is lost.&lt;br /&gt;
* Resume in cluster: If the disk was previously part of a cluster it can be resumed. &lt;br /&gt;
:The data on that disk is now part of the packet ring buffer.&lt;br /&gt;
* Remove from cluster: Remove the disk from the ring buffer. &lt;br /&gt;
:The data stored on that disk is no longer not part of the packet ring buffer but the data is not removed from the disk. It can be resumed in the cluster at a later time.&lt;br /&gt;
&lt;br /&gt;
:If a disk is missing because it was e.g. removed from the enclosure, it will be displayed in a separate list with much of the information as in the list described above but only one button with the option to remove it from the cluster packet ring buffer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster4.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Packet ring buffer snapshot length filter ====&lt;br /&gt;
Rules can be configured that control the snapshot length of each packet which will be stored in the packet ring buffer. &lt;br /&gt;
These rules can also be used to prevent certain packets from being stored in the packet ring buffer. &lt;br /&gt;
This allows to fine tune how much packet data needs to be written to the packet ring buffer. &lt;br /&gt;
The information about the original length of a packet will still be available in captures except when the packet was not written to the packet ring buffer at all (e.g. due to a &#039;&#039;&#039;discard&#039;&#039;&#039; rule). &lt;br /&gt;
&lt;br /&gt;
These rules can be created, edited, deleted, moved up and moved down in the rules list by using the respective buttons.&lt;br /&gt;
&lt;br /&gt;
Evaluation of the rules takes place in the order of the rules as displayed in the rules list from top to bottom. &lt;br /&gt;
The first rule that matches for a given packet will be applied and no further rules will be evaluated for that packet. &lt;br /&gt;
This means that the most generic rule should be at the bottom of the list (like e.g. ‘all packets will be discarded’) and more specific rules should be higher up in the list (like e.g ‘packets with an IP matching 192.168.1.0/24 will be fully captured’).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
When creating a snapshot length filter rule, a dialogue is displayed and allows the following options:&lt;br /&gt;
* Rule condition: Specify which packets to match.&lt;br /&gt;
&lt;br /&gt;
:The input field below allows entering the corresponding value.&lt;br /&gt;
&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Rule condition&lt;br /&gt;
! description&lt;br /&gt;
|-&lt;br /&gt;
| All packets&lt;br /&gt;
| everything&lt;br /&gt;
|-&lt;br /&gt;
| MAC address&lt;br /&gt;
| source or destination MAC address&lt;br /&gt;
|-&lt;br /&gt;
| IP address&lt;br /&gt;
| source or destination IP address or subnet&lt;br /&gt;
|-&lt;br /&gt;
| TCP port&lt;br /&gt;
| the source or destination TCP port&lt;br /&gt;
|-&lt;br /&gt;
| UDP port&lt;br /&gt;
| the source or destination UDP port&lt;br /&gt;
|-&lt;br /&gt;
| Layer 7 protocol&lt;br /&gt;
| the selected Layer 7 protocol&lt;br /&gt;
|-&lt;br /&gt;
| outer VLAN tag&lt;br /&gt;
| the most outer VLAN tag (directly after Ethernet header) &lt;br /&gt;
|-&lt;br /&gt;
| interface&lt;br /&gt;
| the ingress interface the packet originated from&lt;br /&gt;
|-&lt;br /&gt;
| SIP phone number&lt;br /&gt;
|&lt;br /&gt;
The number matches part of the &#039;From:&#039; or &#039;To:&#039; entry in a SIP INVITE packet.&lt;br /&gt;
* only the part between &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;lt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; and &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;gt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; of the From/To line is tested.&lt;br /&gt;
* value &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; will match &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller1&amp;quot; &amp;lt;sip:234&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;, but also &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller2&amp;quot; &amp;lt;sip:12345@test&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;&lt;br /&gt;
* to match from the start, use &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;sip:234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Correlating SIP packets for the same Call-ID will match.&lt;br /&gt;
&lt;br /&gt;
The RTP packets correlated to this SIP call will also match.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
| virtual link group&lt;br /&gt;
| the virtual link group the packet belongs to&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Negate: Controls comparison of the rule condition to the value. If this is off, the value must match. &lt;br /&gt;
:If this is on, the value must not match.&lt;br /&gt;
* Action: What shall be done with the matching packets.&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Action !! Description&lt;br /&gt;
|-&lt;br /&gt;
| Snapshot length&lt;br /&gt;
| The packet is captured with a max length as specified in the input field below. If the packet is larger, the remaining bytes will be discarded.&lt;br /&gt;
|-&lt;br /&gt;
| Discard&lt;br /&gt;
| Discard the whole packet.&lt;br /&gt;
|-&lt;br /&gt;
| Full&lt;br /&gt;
| The entire packet is captured.&lt;br /&gt;
|-&lt;br /&gt;
| Header + data&lt;br /&gt;
|&lt;br /&gt;
Capture just certain parts of the packet.&lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 header&#039;&#039;&#039;, Layer 2 and Layer 3 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 header&#039;&#039;&#039;, Layer 2, 3 and 4 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 + L7 data&#039;&#039;&#039;, an input field is shown where the length of Layer 7 data can be configured.  In this case Layers 2, 3 and 4 are stored together with the specified amount of Layer 7 data.&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Analyzing the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is activated, it is possible to restart the packet processing core and analyze all packets contained in the packet ring buffer. &lt;br /&gt;
When the Analyze packet ring buffer button is pressed, a dialogue will appear which allows you to choose the time range of the packet ring buffer which is to be replayed. &lt;br /&gt;
After confirming this dialogue, the Network Multimeter will reset all statistics and start analyzing the contents of the packet ring buffer. &lt;br /&gt;
Progress, statistics and the option to resume normal operation will appear on the Packet ring buffer page.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== Extracting the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is active, the entire contents can be extracted by capturing the complete timespan that is contained within. &lt;br /&gt;
For convenience, a button labelled Extract packet ring buffer is available that opens the capture dialogue with the start time and end time set to the appropriate values.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3056</id>
		<title>Packet ring buffer</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3056"/>
		<updated>2020-10-09T10:23:02Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Packet ring buffer==&lt;br /&gt;
The ring buffer feature allows to create a buffer of fixed size on an external storage device to which all processed packets will be recorded. &lt;br /&gt;
If the fixed size buffer is full then the oldest packets in the buffer will be replaced with new packets in a round-robin fashion. &lt;br /&gt;
If the feature is not enabled, a button titled &#039;&#039;&#039;Create ring buffer&#039;&#039;&#039; is visible. &lt;br /&gt;
Upon clicking on it a dialogue will be displayed and allows you to specify the size of the ring buffer. &lt;br /&gt;
It must be ensured that enough space is available on the external storage device. &lt;br /&gt;
As soon as the ring buffer has been created, statistics about the ring buffer will be displayed instead of the button:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer1.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
* Timestamp of oldest packet: The timestamp of the oldest packet in the ring buffer.&lt;br /&gt;
&lt;br /&gt;
* Total size: The total size of the ring buffer on the external storage device. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication, an adjusted value is displayed to reflect the redundant copies of packet data. &lt;br /&gt;
:The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
&lt;br /&gt;
* Used size: The currently used amount of memory in the capture buffer. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication, an adjusted value is displayed to reflect the redundant copies of packet data. The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
* Overall bytes captured since start: The amount of captured bytes since system start. &lt;br /&gt;
:This may be smaller than the used size if the system has been restarted. And it may be larger than the used size in case the ring buffer is full. &lt;br /&gt;
:The history graph shows the captured traffic of the last minute or in the selected interval (if set).&lt;br /&gt;
* Bytes dropped since start: The traffic which was processed but could not be written to the ring buffer since the start of processing. &lt;br /&gt;
:This is usually an indicator that writes to the external storage device were not fast enough.  The history graph shows the drops over time.&lt;br /&gt;
* Bytes discarded due to snapshot length rules since start: The traffic which matched the snapshot length rules criteria and was not written to the ring buffer. &lt;br /&gt;
:The history graph shows discarding over time.&lt;br /&gt;
* Data in flight: The amount of data which is currently stored in the queue that holds processed packets before they are written to the packet ring buffer. &lt;br /&gt;
:If larger bursts of traffic need to be stored in this queue, the size can be modified in the capture module settings.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer2.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
When the ring buffer is full and old packets are deleted, the graphs will show the time range with no data with a dark grey background colour. &lt;br /&gt;
The time range before start of the ring buffer will be visualized in the same way.&lt;br /&gt;
When the ring buffer is running, the behaviour of the pcap capture buttons throughout the system changes: if the user interface is in live mode and a capture is started, a dialogue will appear asking you to specify from how far back in time the capture should start. &lt;br /&gt;
This way it is possible to e.g. capture the traffic of an IP address starting from an hour ago. &lt;br /&gt;
The capture will also continue with live traffic. &lt;br /&gt;
If the user interface is in &#039;&#039;&#039;back-in-time&#039;&#039;&#039; mode (a timespan from the past is selected) starting a capture will produce a dialogue asking to confirm that the capture will cover exactly the timespan selected. &lt;br /&gt;
The capture will automatically stop after the selected timespan has been processed. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer3.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Cluster ring buffer ==== &lt;br /&gt;
The cluster ring buffer feature allows to use multiple whole disks in parallel for a single packet ring buffer. &lt;br /&gt;
It also allows you to optionally write redundant copies of packets to multiple disks to provide fault tolerance in case of a disk failure.&lt;br /&gt;
&lt;br /&gt;
It is also possible to create multiple cluster packet ring buffers that&lt;br /&gt;
run in parallel. To enable multiple cluster packet ring buffers, the&lt;br /&gt;
option `The maximum number of concurrent packet ring buffers` in the&lt;br /&gt;
capture module options can be set to the required number.&lt;br /&gt;
&lt;br /&gt;
When clicking the &#039;&#039;&#039;Create cluster ring buffer&#039;&#039;&#039; button, an empty cluster ring buffer will be created and the &#039;&#039;&#039;Cluster configuration&#039;&#039;&#039; tab on the now visible packet ring buffer statistics page becomes available. &lt;br /&gt;
&lt;br /&gt;
If multiple cluster packet ring buffers are used, the page will show&lt;br /&gt;
a number of buttons at the top to switch between the different clusters.&lt;br /&gt;
Each cluster has its own statistics and configuration.&lt;br /&gt;
&lt;br /&gt;
In the Cluster configuration tab you can configure the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; at the very top. &lt;br /&gt;
This level controls how many redundant copies of each packet are written. &lt;br /&gt;
No replication means that only a single copy of each packet is written and provides no redundancy. &lt;br /&gt;
This level gives the highest write bandwidth for a given number of disks; single replication means that one additional copy of each packet is written to some other disk and thus reduces the total write performance for a given number of disks to half the performance of no replication. &lt;br /&gt;
Double replication and triple replication write two and three additional copies of each packet respectively. &lt;br /&gt;
Note that for each level to work there must be at least the number of replications + 1 disks available in the cluster.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster3.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Below the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; setting is the list of all disks available for use in the cluster. &lt;br /&gt;
The following columns are displayed in the list:&lt;br /&gt;
* Disk: A description of the disk and its capacity.&lt;br /&gt;
* Enclosure: If the disk is part of a multi-disk enclosure this column will show the enclosure number along with the slot number.&lt;br /&gt;
* Status: If the disk has been added to the cluster this column will display the current status as &#039;&#039;&#039;ok&#039;&#039;&#039; or &#039;&#039;&#039;failed&#039;&#039;&#039;. If multiple cluster packet ring buffers are used this will also show if the disk is active in another cluster.&lt;br /&gt;
* Locator: For disks in a multi-disk enclosure the button displayed in this column allows to turn the slot locator LED on and off. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
In the last unlabelled column, three buttons are displayed which have the following functionality:&lt;br /&gt;
* Add to cluster: Add a fresh disk to the cluster. &lt;br /&gt;
:The disk will be formatted and added as empty storage to the cluster. All previous data on the disk is lost.&lt;br /&gt;
* Resume in cluster: If the disk was previously part of a cluster it can be resumed. &lt;br /&gt;
:The data on that disk is now part of the packet ring buffer.&lt;br /&gt;
* Remove from cluster: Remove the disk from the ring buffer. &lt;br /&gt;
:The data stored on that disk is no longer not part of the packet ring buffer but the data is not removed from the disk. It can be resumed in the cluster at a later time.&lt;br /&gt;
&lt;br /&gt;
:If a disk is missing because it was e.g. removed from the enclosure, it will be displayed in a separate list with much of the information as in the list described above but only one button with the option to remove it from the cluster packet ring buffer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster4.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Packet ring buffer snapshot length filter ====&lt;br /&gt;
Rules can be configured that control the snapshot length of each packet which will be stored in the packet ring buffer. &lt;br /&gt;
These rules can also be used to prevent certain packets from being stored in the packet ring buffer. &lt;br /&gt;
This allows to fine tune how much packet data needs to be written to the packet ring buffer. &lt;br /&gt;
The information about the original length of a packet will still be available in captures except when the packet was not written to the packet ring buffer at all (e.g. due to a &#039;&#039;&#039;discard&#039;&#039;&#039; rule). &lt;br /&gt;
&lt;br /&gt;
These rules can be created, edited, deleted, moved up and moved down in the rules list by using the respective buttons.&lt;br /&gt;
&lt;br /&gt;
Evaluation of the rules takes place in the order of the rules as displayed in the rules list from top to bottom. &lt;br /&gt;
The first rule that matches for a given packet will be applied and no further rules will be evaluated for that packet. &lt;br /&gt;
This means that the most generic rule should be at the bottom of the list (like e.g. ‘all packets will be discarded’) and more specific rules should be higher up in the list (like e.g ‘packets with an IP matching 192.168.1.0/24 will be fully captured’).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
When creating a snapshot length filter rule, a dialogue is displayed and allows the following options:&lt;br /&gt;
* Rule condition: Specify which packets to match.&lt;br /&gt;
&lt;br /&gt;
:The input field below allows entering the corresponding value.&lt;br /&gt;
&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Rule condition&lt;br /&gt;
! description&lt;br /&gt;
|-&lt;br /&gt;
| All packets&lt;br /&gt;
| everything&lt;br /&gt;
|-&lt;br /&gt;
| MAC address&lt;br /&gt;
| source or destination MAC address&lt;br /&gt;
|-&lt;br /&gt;
| IP address&lt;br /&gt;
| source or destination IP address or subnet&lt;br /&gt;
|-&lt;br /&gt;
| TCP port&lt;br /&gt;
| the source or destination TCP port&lt;br /&gt;
|-&lt;br /&gt;
| UDP port&lt;br /&gt;
| the source or destination UDP port&lt;br /&gt;
|-&lt;br /&gt;
| Layer 7 protocol&lt;br /&gt;
| the selected Layer 7 protocol&lt;br /&gt;
|-&lt;br /&gt;
| outer VLAN tag&lt;br /&gt;
| the most outer VLAN tag (directly after Ethernet header) &lt;br /&gt;
|-&lt;br /&gt;
| interface&lt;br /&gt;
| the ingress interface the packet originated from&lt;br /&gt;
|-&lt;br /&gt;
| SIP phone number&lt;br /&gt;
|&lt;br /&gt;
The number matches part of the &#039;From:&#039; or &#039;To:&#039; entry in a SIP INVITE packet.&lt;br /&gt;
* only the part between &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;lt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; and &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;gt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; of the From/To line is tested.&lt;br /&gt;
* value &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; will match &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller1&amp;quot; &amp;lt;sip:234&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;, but also &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller2&amp;quot; &amp;lt;sip:12345@test&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;&lt;br /&gt;
* to match from the start, use &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;sip:234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Correlating SIP packets for the same Call-ID will match.&lt;br /&gt;
&lt;br /&gt;
The RTP packets correlated to this SIP call will also match.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
| virtual link group&lt;br /&gt;
| the virtual link group the packet belongs to&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Negate: Controls comparison of the rule condition to the value. If this is off, the value must match. &lt;br /&gt;
:If this is on, the value must not match.&lt;br /&gt;
* Action: What shall be done with the matching packets.&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Action !! Description&lt;br /&gt;
|-&lt;br /&gt;
| Snapshot length&lt;br /&gt;
| The packet is captured with a max length as specified in the input field below. If the packet is larger, the remaining bytes will be discarded.&lt;br /&gt;
|-&lt;br /&gt;
| Discard&lt;br /&gt;
| Discard the whole packet.&lt;br /&gt;
|-&lt;br /&gt;
| Full&lt;br /&gt;
| The entire packet is captured.&lt;br /&gt;
|-&lt;br /&gt;
| Header + data&lt;br /&gt;
|&lt;br /&gt;
Capture just certain parts of the packet.&lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 header&#039;&#039;&#039;, Layer 2 and Layer 3 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 header&#039;&#039;&#039;, Layer 2, 3 and 4 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 + L7 data&#039;&#039;&#039;, an input field is shown where the length of Layer 7 data can be configured.  In this case Layers 2, 3 and 4 are stored together with the specified amount of Layer 7 data.&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Analyzing the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is activated, it is possible to restart the packet processing core and analyze all packets contained in the packet ring buffer. &lt;br /&gt;
When the Analyze packet ring buffer button is pressed, a dialogue will appear which allows you to choose the time range of the packet ring buffer which is to be replayed. &lt;br /&gt;
After confirming this dialogue, the Network Multimeter will reset all statistics and start analyzing the contents of the packet ring buffer. &lt;br /&gt;
Progress, statistics and the option to resume normal operation will appear on the Packet ring buffer page.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== Extracting the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is active, the entire contents can be extracted by capturing the complete timespan that is contained within. &lt;br /&gt;
For convenience, a button labelled Extract packet ring buffer is available that opens the capture dialogue with the start time and end time set to the appropriate values.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3055</id>
		<title>Packet ring buffer</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3055"/>
		<updated>2020-10-09T10:21:36Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Packet ring buffer==&lt;br /&gt;
The ring buffer feature allows to create a buffer of fixed size on an external storage device to which all processed packets will be recorded. &lt;br /&gt;
If the fixed size buffer is full then the oldest packets in the buffer will be replaced with new packets in a round-robin fashion. &lt;br /&gt;
If the feature is not enabled, a button titled &#039;&#039;&#039;Create ring buffer&#039;&#039;&#039; is visible. &lt;br /&gt;
Upon clicking on it a dialogue will be displayed and allows you to specify the size of the ring buffer. &lt;br /&gt;
It must be ensured that enough space is available on the external storage device. &lt;br /&gt;
As soon as the ring buffer has been created, statistics about the ring buffer will be displayed instead of the button:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer1.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
* Timestamp of oldest packet: The timestamp of the oldest packet in the ring buffer.&lt;br /&gt;
&lt;br /&gt;
* Total size: The total size of the ring buffer on the external storage device. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication, an adjusted value is displayed to reflect the redundant copies of packet data. &lt;br /&gt;
:The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
&lt;br /&gt;
* Used size: The currently used amount of memory in the capture buffer. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication, an adjusted value is displayed to reflect the redundant copies of packet data. The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
* Overall bytes captured since start: The amount of captured bytes since system start. &lt;br /&gt;
:This may be smaller than the used size if the system has been restarted. And it may be larger than the used size in case the ring buffer is full. &lt;br /&gt;
:The history graph shows the captured traffic of the last minute or in the selected interval (if set).&lt;br /&gt;
* Bytes dropped since start: The traffic which was processed but could not be written to the ring buffer since the start of processing. &lt;br /&gt;
:This is usually an indicator that writes to the external storage device were not fast enough.  The history graph shows the drops over time.&lt;br /&gt;
* Bytes discarded due to snapshot length rules since start: The traffic which matched the snapshot length rules criteria and was not written to the ring buffer. &lt;br /&gt;
:The history graph shows discarding over time.&lt;br /&gt;
* Data in flight: The amount of data which is currently stored in the queue that holds processed packets before they are written to the packet ring buffer. &lt;br /&gt;
:If larger bursts of traffic need to be stored in this queue the size can be modified in the capture module settings.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer2.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
When the ring buffer is full and old packets are deleted, the graphs will show the time range with no data with a dark grey background colour. &lt;br /&gt;
The time range before start of the ring buffer will be visualized in the same way.&lt;br /&gt;
When the ring buffer is running, the behaviour of the pcap capture buttons throughout the system changes: if the user interface is in live mode and a capture is started, a dialogue will appear asking you to specify from how far back in time the capture should start. &lt;br /&gt;
This way it is possible to e.g. capture the traffic of an IP address starting from an hour ago. &lt;br /&gt;
The capture will also continue with live traffic. &lt;br /&gt;
If the user interface is in &#039;&#039;&#039;back-in-time&#039;&#039;&#039; mode (a timespan from the past is selected) starting a capture will produce a dialogue asking to confirm that the capture will cover exactly the timespan selected. &lt;br /&gt;
The capture will automatically stop after the selected timespan has been processed. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer3.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Cluster ring buffer ==== &lt;br /&gt;
The cluster ring buffer feature allows to use multiple whole disks in parallel for a single packet ring buffer. &lt;br /&gt;
It also allows you to optionally write redundant copies of packets to multiple disks to provide fault tolerance in case of a disk failure.&lt;br /&gt;
&lt;br /&gt;
It is also possible to create multiple cluster packet ring buffers that&lt;br /&gt;
run in parallel. To enable multiple cluster packet ring buffers, the&lt;br /&gt;
option `The maximum number of concurrent packet ring buffers` in the&lt;br /&gt;
capture module options can be set to the required number.&lt;br /&gt;
&lt;br /&gt;
When clicking the &#039;&#039;&#039;Create cluster ring buffer&#039;&#039;&#039; button, an empty cluster ring buffer will be created and the &#039;&#039;&#039;Cluster configuration&#039;&#039;&#039; tab on the now visible packet ring buffer statistics page becomes available. &lt;br /&gt;
&lt;br /&gt;
If multiple cluster packet ring buffers are used, the page will show&lt;br /&gt;
a number of buttons at the top to switch between the different clusters.&lt;br /&gt;
Each cluster has its own statistics and configuration.&lt;br /&gt;
&lt;br /&gt;
In the Cluster configuration tab you can configure the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; at the very top. &lt;br /&gt;
This level controls how many redundant copies of each packet are written. &lt;br /&gt;
No replication means that only a single copy of each packet is written and provides no redundancy. &lt;br /&gt;
This level gives the highest write bandwidth for a given number of disks; single replication means that one additional copy of each packet is written to some other disk and thus reduces the total write performance for a given number of disks to half the performance of no replication. &lt;br /&gt;
Double replication and triple replication write two and three additional copies of each packet respectively. &lt;br /&gt;
Note that for each level to work there must be at least the number of replications + 1 disks available in the cluster.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster3.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Below the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; setting is the list of all disks available for use in the cluster. &lt;br /&gt;
The following columns are displayed in the list:&lt;br /&gt;
* Disk: A description of the disk and its capacity.&lt;br /&gt;
* Enclosure: If the disk is part of a multi-disk enclosure this column will show the enclosure number along with the slot number.&lt;br /&gt;
* Status: If the disk has been added to the cluster this column will display the current status as &#039;&#039;&#039;ok&#039;&#039;&#039; or &#039;&#039;&#039;failed&#039;&#039;&#039;. If multiple cluster packet ring buffers are used this will also show if the disk is active in another cluster.&lt;br /&gt;
* Locator: For disks in a multi-disk enclosure the button displayed in this column allows to turn the slot locator LED on and off. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
In the last unlabelled column, three buttons are displayed which have the following functionality:&lt;br /&gt;
* Add to cluster: Add a fresh disk to the cluster. &lt;br /&gt;
:The disk will be formatted and added as empty storage to the cluster. All previous data on the disk is lost.&lt;br /&gt;
* Resume in cluster: If the disk was previously part of a cluster it can be resumed. &lt;br /&gt;
:The data on that disk is now part of the packet ring buffer.&lt;br /&gt;
* Remove from cluster: Remove the disk from the ring buffer. &lt;br /&gt;
:The data stored on that disk is no longer not part of the packet ring buffer but the data is not removed from the disk. It can be resumed in the cluster at a later time.&lt;br /&gt;
&lt;br /&gt;
:If a disk is missing because it was e.g. removed from the enclosure, it will be displayed in a separate list with much of the information as in the list described above but only one button with the option to remove it from the cluster packet ring buffer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster4.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Packet ring buffer snapshot length filter ====&lt;br /&gt;
Rules can be configured that control the snapshot length of each packet which will be stored in the packet ring buffer. &lt;br /&gt;
These rules can also be used to prevent certain packets from being stored in the packet ring buffer. &lt;br /&gt;
This allows to fine tune how much packet data needs to be written to the packet ring buffer. &lt;br /&gt;
The information about the original length of a packet will still be available in captures except when the packet was not written to the packet ring buffer at all (e.g. due to a &#039;&#039;&#039;discard&#039;&#039;&#039; rule). &lt;br /&gt;
&lt;br /&gt;
These rules can be created, edited, deleted, moved up and moved down in the rules list by using the respective buttons.&lt;br /&gt;
&lt;br /&gt;
Evaluation of the rules takes place in the order of the rules as displayed in the rules list from top to bottom. &lt;br /&gt;
The first rule that matches for a given packet will be applied and no further rules will be evaluated for that packet. &lt;br /&gt;
This means that the most generic rule should be at the bottom of the list (like e.g. ‘all packets will be discarded’) and more specific rules should be higher up in the list (like e.g ‘packets with an IP matching 192.168.1.0/24 will be fully captured’).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
When creating a snapshot length filter rule, a dialogue is displayed and allows the following options:&lt;br /&gt;
* Rule condition: Specify which packets to match.&lt;br /&gt;
&lt;br /&gt;
:The input field below allows entering the corresponding value.&lt;br /&gt;
&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Rule condition&lt;br /&gt;
! description&lt;br /&gt;
|-&lt;br /&gt;
| All packets&lt;br /&gt;
| everything&lt;br /&gt;
|-&lt;br /&gt;
| MAC address&lt;br /&gt;
| source or destination MAC address&lt;br /&gt;
|-&lt;br /&gt;
| IP address&lt;br /&gt;
| source or destination IP address or subnet&lt;br /&gt;
|-&lt;br /&gt;
| TCP port&lt;br /&gt;
| the source or destination TCP port&lt;br /&gt;
|-&lt;br /&gt;
| UDP port&lt;br /&gt;
| the source or destination UDP port&lt;br /&gt;
|-&lt;br /&gt;
| Layer 7 protocol&lt;br /&gt;
| the selected Layer 7 protocol&lt;br /&gt;
|-&lt;br /&gt;
| outer VLAN tag&lt;br /&gt;
| the most outer VLAN tag (directly after Ethernet header) &lt;br /&gt;
|-&lt;br /&gt;
| interface&lt;br /&gt;
| the ingress interface the packet originated from&lt;br /&gt;
|-&lt;br /&gt;
| SIP phone number&lt;br /&gt;
|&lt;br /&gt;
The number matches part of the &#039;From:&#039; or &#039;To:&#039; entry in a SIP INVITE packet.&lt;br /&gt;
* only the part between &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;lt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; and &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;gt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; of the From/To line is tested.&lt;br /&gt;
* value &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; will match &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller1&amp;quot; &amp;lt;sip:234&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;, but also &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller2&amp;quot; &amp;lt;sip:12345@test&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;&lt;br /&gt;
* to match from the start, use &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;sip:234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Correlating SIP packets for the same Call-ID will match.&lt;br /&gt;
&lt;br /&gt;
The RTP packets correlated to this SIP call will also match.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
| virtual link group&lt;br /&gt;
| the virtual link group the packet belongs to&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Negate: Controls comparison of the rule condition to the value. If this is off, the value must match. &lt;br /&gt;
:If this is on, the value must not match.&lt;br /&gt;
* Action: What shall be done with the matching packets.&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Action !! Description&lt;br /&gt;
|-&lt;br /&gt;
| Snapshot length&lt;br /&gt;
| The packet is captured with a max length as specified in the input field below. If the packet is larger, the remaining bytes will be discarded.&lt;br /&gt;
|-&lt;br /&gt;
| Discard&lt;br /&gt;
| Discard the whole packet.&lt;br /&gt;
|-&lt;br /&gt;
| Full&lt;br /&gt;
| The entire packet is captured.&lt;br /&gt;
|-&lt;br /&gt;
| Header + data&lt;br /&gt;
|&lt;br /&gt;
Capture just certain parts of the packet.&lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 header&#039;&#039;&#039;, Layer 2 and Layer 3 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 header&#039;&#039;&#039;, Layer 2, 3 and 4 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 + L7 data&#039;&#039;&#039;, an input field is shown where the length of Layer 7 data can be configured.  In this case Layers 2, 3 and 4 are stored together with the specified amount of Layer 7 data.&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Analyzing the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is activated, it is possible to restart the packet processing core and analyze all packets contained in the packet ring buffer. &lt;br /&gt;
When the Analyze packet ring buffer button is pressed, a dialogue will appear which allows you to choose the time range of the packet ring buffer which is to be replayed. &lt;br /&gt;
After confirming this dialogue, the Network Multimeter will reset all statistics and start analyzing the contents of the packet ring buffer. &lt;br /&gt;
Progress, statistics and the option to resume normal operation will appear on the Packet ring buffer page.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== Extracting the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is active, the entire contents can be extracted by capturing the complete timespan that is contained within. &lt;br /&gt;
For convenience, a button labelled Extract packet ring buffer is available that opens the capture dialogue with the start time and end time set to the appropriate values.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3054</id>
		<title>Packet ring buffer</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3054"/>
		<updated>2020-10-09T10:20:42Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Packet ring buffer==&lt;br /&gt;
The ring buffer feature allows to create a buffer of fixed size on an external storage device to which all processed packets will be recorded. &lt;br /&gt;
If the fixed size buffer is full then the oldest packets in the buffer will be replaced with new packets in a round-robin fashion. &lt;br /&gt;
If the feature is not enabled, a button titled &#039;&#039;&#039;Create ring buffer&#039;&#039;&#039; is visible. &lt;br /&gt;
Upon clicking on it a dialogue will be displayed and allows you to specify the size of the ring buffer. &lt;br /&gt;
It must be ensured that enough space is available on the external storage device. &lt;br /&gt;
As soon as the ring buffer has been created, statistics about the ring buffer will be displayed instead of the button:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer1.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
* Timestamp of oldest packet: The timestamp of the oldest packet in the ring buffer.&lt;br /&gt;
&lt;br /&gt;
* Total size: The total size of the ring buffer on the external storage device. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication an adjusted value is displayed to reflect the redundant copies of packet data. &lt;br /&gt;
:The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
&lt;br /&gt;
* Used size: The currently used amount of memory in the capture buffer. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication an adjusted value is displayed to reflect the redundant copies of packet data. The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
* Overall bytes captured since start: The amount of captured bytes since system start. &lt;br /&gt;
:This may be smaller than the used size if the system has been restarted. And it may be larger than the used size in case the ring buffer is full. &lt;br /&gt;
:The history graph shows the captured traffic of the last minute or in the selected interval (if set).&lt;br /&gt;
* Bytes dropped since start: The traffic which was processed but could not be written to the ring buffer since the start of processing. &lt;br /&gt;
:This is usually an indicator that writes to the external storage device were not fast enough.  The history graph shows the drops over time.&lt;br /&gt;
* Bytes discarded due to snapshot length rules since start: The traffic which matched the snapshot length rules criteria and was not written to the ring buffer. &lt;br /&gt;
:The history graph shows discarding over time.&lt;br /&gt;
* Data in flight: The amount of data which is currently stored in the queue that holds processed packets before they are written to the packet ring buffer. &lt;br /&gt;
:If larger bursts of traffic need to be stored in this queue the size can be modified in the capture module settings.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer2.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
When the ring buffer is full and old packets are deleted, the graphs will show the time range with no data with a dark grey background colour. &lt;br /&gt;
The time range before start of the ring buffer will be visualized in the same way.&lt;br /&gt;
When the ring buffer is running, the behaviour of the pcap capture buttons throughout the system changes: if the user interface is in live mode and a capture is started, a dialogue will appear asking you to specify from how far back in time the capture should start. &lt;br /&gt;
This way it is possible to e.g. capture the traffic of an IP address starting from an hour ago. &lt;br /&gt;
The capture will also continue with live traffic. &lt;br /&gt;
If the user interface is in &#039;&#039;&#039;back-in-time&#039;&#039;&#039; mode (a timespan from the past is selected) starting a capture will produce a dialogue asking to confirm that the capture will cover exactly the timespan selected. &lt;br /&gt;
The capture will automatically stop after the selected timespan has been processed. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer3.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Cluster ring buffer ==== &lt;br /&gt;
The cluster ring buffer feature allows to use multiple whole disks in parallel for a single packet ring buffer. &lt;br /&gt;
It also allows you to optionally write redundant copies of packets to multiple disks to provide fault tolerance in case of a disk failure.&lt;br /&gt;
&lt;br /&gt;
It is also possible to create multiple cluster packet ring buffers that&lt;br /&gt;
run in parallel. To enable multiple cluster packet ring buffers, the&lt;br /&gt;
option `The maximum number of concurrent packet ring buffers` in the&lt;br /&gt;
capture module options can be set to the required number.&lt;br /&gt;
&lt;br /&gt;
When clicking the &#039;&#039;&#039;Create cluster ring buffer&#039;&#039;&#039; button, an empty cluster ring buffer will be created and the &#039;&#039;&#039;Cluster configuration&#039;&#039;&#039; tab on the now visible packet ring buffer statistics page becomes available. &lt;br /&gt;
&lt;br /&gt;
If multiple cluster packet ring buffers are used, the page will show&lt;br /&gt;
a number of buttons at the top to switch between the different clusters.&lt;br /&gt;
Each cluster has its own statistics and configuration.&lt;br /&gt;
&lt;br /&gt;
In the Cluster configuration tab you can configure the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; at the very top. &lt;br /&gt;
This level controls how many redundant copies of each packet are written. &lt;br /&gt;
No replication means that only a single copy of each packet is written and provides no redundancy. &lt;br /&gt;
This level gives the highest write bandwidth for a given number of disks; single replication means that one additional copy of each packet is written to some other disk and thus reduces the total write performance for a given number of disks to half the performance of no replication. &lt;br /&gt;
Double replication and triple replication write two and three additional copies of each packet respectively. &lt;br /&gt;
Note that for each level to work there must be at least the number of replications + 1 disks available in the cluster.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster3.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Below the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; setting is the list of all disks available for use in the cluster. &lt;br /&gt;
The following columns are displayed in the list:&lt;br /&gt;
* Disk: A description of the disk and its capacity.&lt;br /&gt;
* Enclosure: If the disk is part of a multi-disk enclosure this column will show the enclosure number along with the slot number.&lt;br /&gt;
* Status: If the disk has been added to the cluster this column will display the current status as &#039;&#039;&#039;ok&#039;&#039;&#039; or &#039;&#039;&#039;failed&#039;&#039;&#039;. If multiple cluster packet ring buffers are used this will also show if the disk is active in another cluster.&lt;br /&gt;
* Locator: For disks in a multi-disk enclosure the button displayed in this column allows to turn the slot locator LED on and off. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
In the last unlabelled column, three buttons are displayed which have the following functionality:&lt;br /&gt;
* Add to cluster: Add a fresh disk to the cluster. &lt;br /&gt;
:The disk will be formatted and added as empty storage to the cluster. All previous data on the disk is lost.&lt;br /&gt;
* Resume in cluster: If the disk was previously part of a cluster it can be resumed. &lt;br /&gt;
:The data on that disk is now part of the packet ring buffer.&lt;br /&gt;
* Remove from cluster: Remove the disk from the ring buffer. &lt;br /&gt;
:The data stored on that disk is no longer not part of the packet ring buffer but the data is not removed from the disk. It can be resumed in the cluster at a later time.&lt;br /&gt;
&lt;br /&gt;
:If a disk is missing because it was e.g. removed from the enclosure, it will be displayed in a separate list with much of the information as in the list described above but only one button with the option to remove it from the cluster packet ring buffer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster4.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Packet ring buffer snapshot length filter ====&lt;br /&gt;
Rules can be configured that control the snapshot length of each packet which will be stored in the packet ring buffer. &lt;br /&gt;
These rules can also be used to prevent certain packets from being stored in the packet ring buffer. &lt;br /&gt;
This allows to fine tune how much packet data needs to be written to the packet ring buffer. &lt;br /&gt;
The information about the original length of a packet will still be available in captures except when the packet was not written to the packet ring buffer at all (e.g. due to a &#039;&#039;&#039;discard&#039;&#039;&#039; rule). &lt;br /&gt;
&lt;br /&gt;
These rules can be created, edited, deleted, moved up and moved down in the rules list by using the respective buttons.&lt;br /&gt;
&lt;br /&gt;
Evaluation of the rules takes place in the order of the rules as displayed in the rules list from top to bottom. &lt;br /&gt;
The first rule that matches for a given packet will be applied and no further rules will be evaluated for that packet. &lt;br /&gt;
This means that the most generic rule should be at the bottom of the list (like e.g. ‘all packets will be discarded’) and more specific rules should be higher up in the list (like e.g ‘packets with an IP matching 192.168.1.0/24 will be fully captured’).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
When creating a snapshot length filter rule, a dialogue is displayed and allows the following options:&lt;br /&gt;
* Rule condition: Specify which packets to match.&lt;br /&gt;
&lt;br /&gt;
:The input field below allows entering the corresponding value.&lt;br /&gt;
&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Rule condition&lt;br /&gt;
! description&lt;br /&gt;
|-&lt;br /&gt;
| All packets&lt;br /&gt;
| everything&lt;br /&gt;
|-&lt;br /&gt;
| MAC address&lt;br /&gt;
| source or destination MAC address&lt;br /&gt;
|-&lt;br /&gt;
| IP address&lt;br /&gt;
| source or destination IP address or subnet&lt;br /&gt;
|-&lt;br /&gt;
| TCP port&lt;br /&gt;
| the source or destination TCP port&lt;br /&gt;
|-&lt;br /&gt;
| UDP port&lt;br /&gt;
| the source or destination UDP port&lt;br /&gt;
|-&lt;br /&gt;
| Layer 7 protocol&lt;br /&gt;
| the selected Layer 7 protocol&lt;br /&gt;
|-&lt;br /&gt;
| outer VLAN tag&lt;br /&gt;
| the most outer VLAN tag (directly after Ethernet header) &lt;br /&gt;
|-&lt;br /&gt;
| interface&lt;br /&gt;
| the ingress interface the packet originated from&lt;br /&gt;
|-&lt;br /&gt;
| SIP phone number&lt;br /&gt;
|&lt;br /&gt;
The number matches part of the &#039;From:&#039; or &#039;To:&#039; entry in a SIP INVITE packet.&lt;br /&gt;
* only the part between &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;lt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; and &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;gt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; of the From/To line is tested.&lt;br /&gt;
* value &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; will match &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller1&amp;quot; &amp;lt;sip:234&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;, but also &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller2&amp;quot; &amp;lt;sip:12345@test&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;&lt;br /&gt;
* to match from the start, use &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;sip:234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Correlating SIP packets for the same Call-ID will match.&lt;br /&gt;
&lt;br /&gt;
The RTP packets correlated to this SIP call will also match.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
| virtual link group&lt;br /&gt;
| the virtual link group the packet belongs to&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Negate: Controls comparison of the rule condition to the value. If this is off, the value must match. &lt;br /&gt;
:If this is on, the value must not match.&lt;br /&gt;
* Action: What shall be done with the matching packets.&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Action !! Description&lt;br /&gt;
|-&lt;br /&gt;
| Snapshot length&lt;br /&gt;
| The packet is captured with a max length as specified in the input field below. If the packet is larger, the remaining bytes will be discarded.&lt;br /&gt;
|-&lt;br /&gt;
| Discard&lt;br /&gt;
| Discard the whole packet.&lt;br /&gt;
|-&lt;br /&gt;
| Full&lt;br /&gt;
| The entire packet is captured.&lt;br /&gt;
|-&lt;br /&gt;
| Header + data&lt;br /&gt;
|&lt;br /&gt;
Capture just certain parts of the packet.&lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 header&#039;&#039;&#039;, Layer 2 and Layer 3 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 header&#039;&#039;&#039;, Layer 2, 3 and 4 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 + L7 data&#039;&#039;&#039;, an input field is shown where the length of Layer 7 data can be configured.  In this case Layers 2, 3 and 4 are stored together with the specified amount of Layer 7 data.&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Analyzing the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is activated, it is possible to restart the packet processing core and analyze all packets contained in the packet ring buffer. &lt;br /&gt;
When the Analyze packet ring buffer button is pressed, a dialogue will appear which allows you to choose the time range of the packet ring buffer which is to be replayed. &lt;br /&gt;
After confirming this dialogue, the Network Multimeter will reset all statistics and start analyzing the contents of the packet ring buffer. &lt;br /&gt;
Progress, statistics and the option to resume normal operation will appear on the Packet ring buffer page.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== Extracting the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is active, the entire contents can be extracted by capturing the complete timespan that is contained within. &lt;br /&gt;
For convenience, a button labelled Extract packet ring buffer is available that opens the capture dialogue with the start time and end time set to the appropriate values.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3053</id>
		<title>Packet ring buffer</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3053"/>
		<updated>2020-10-09T10:20:13Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Packet ring buffer==&lt;br /&gt;
The ring buffer feature allows to create a buffer of fixed size on an external storage device to which all processed packets will be recorded. &lt;br /&gt;
If the fixed size buffer is full then the oldest packets in the buffer will be replaced with new packets in a round-robin fashion. &lt;br /&gt;
If the feature is not enabled, a button titled &#039;&#039;&#039;Create ring buffer&#039;&#039;&#039; is visible. &lt;br /&gt;
Upon clicking on it a dialogue will be displayed and allows you to specify the size of the ring buffer. &lt;br /&gt;
It must be ensured that enough space is available on the external storage device. &lt;br /&gt;
As soon as the ring buffer has been created statistics about the ring buffer will be displayed instead of the button:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer1.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
* Timestamp of oldest packet: The timestamp of the oldest packet in the ring buffer.&lt;br /&gt;
&lt;br /&gt;
* Total size: The total size of the ring buffer on the external storage device. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication an adjusted value is displayed to reflect the redundant copies of packet data. &lt;br /&gt;
:The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
&lt;br /&gt;
* Used size: The currently used amount of memory in the capture buffer. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication an adjusted value is displayed to reflect the redundant copies of packet data. The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
* Overall bytes captured since start: The amount of captured bytes since system start. &lt;br /&gt;
:This may be smaller than the used size if the system has been restarted. And it may be larger than the used size in case the ring buffer is full. &lt;br /&gt;
:The history graph shows the captured traffic of the last minute or in the selected interval (if set).&lt;br /&gt;
* Bytes dropped since start: The traffic which was processed but could not be written to the ring buffer since the start of processing. &lt;br /&gt;
:This is usually an indicator that writes to the external storage device were not fast enough.  The history graph shows the drops over time.&lt;br /&gt;
* Bytes discarded due to snapshot length rules since start: The traffic which matched the snapshot length rules criteria and was not written to the ring buffer. &lt;br /&gt;
:The history graph shows discarding over time.&lt;br /&gt;
* Data in flight: The amount of data which is currently stored in the queue that holds processed packets before they are written to the packet ring buffer. &lt;br /&gt;
:If larger bursts of traffic need to be stored in this queue the size can be modified in the capture module settings.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer2.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
When the ring buffer is full and old packets are deleted, the graphs will show the time range with no data with a dark grey background colour. &lt;br /&gt;
The time range before start of the ring buffer will be visualized in the same way.&lt;br /&gt;
When the ring buffer is running, the behaviour of the pcap capture buttons throughout the system changes: if the user interface is in live mode and a capture is started, a dialogue will appear asking you to specify from how far back in time the capture should start. &lt;br /&gt;
This way it is possible to e.g. capture the traffic of an IP address starting from an hour ago. &lt;br /&gt;
The capture will also continue with live traffic. &lt;br /&gt;
If the user interface is in &#039;&#039;&#039;back-in-time&#039;&#039;&#039; mode (a timespan from the past is selected) starting a capture will produce a dialogue asking to confirm that the capture will cover exactly the timespan selected. &lt;br /&gt;
The capture will automatically stop after the selected timespan has been processed. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer3.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Cluster ring buffer ==== &lt;br /&gt;
The cluster ring buffer feature allows to use multiple whole disks in parallel for a single packet ring buffer. &lt;br /&gt;
It also allows you to optionally write redundant copies of packets to multiple disks to provide fault tolerance in case of a disk failure.&lt;br /&gt;
&lt;br /&gt;
It is also possible to create multiple cluster packet ring buffers that&lt;br /&gt;
run in parallel. To enable multiple cluster packet ring buffers, the&lt;br /&gt;
option `The maximum number of concurrent packet ring buffers` in the&lt;br /&gt;
capture module options can be set to the required number.&lt;br /&gt;
&lt;br /&gt;
When clicking the &#039;&#039;&#039;Create cluster ring buffer&#039;&#039;&#039; button, an empty cluster ring buffer will be created and the &#039;&#039;&#039;Cluster configuration&#039;&#039;&#039; tab on the now visible packet ring buffer statistics page becomes available. &lt;br /&gt;
&lt;br /&gt;
If multiple cluster packet ring buffers are used, the page will show&lt;br /&gt;
a number of buttons at the top to switch between the different clusters.&lt;br /&gt;
Each cluster has its own statistics and configuration.&lt;br /&gt;
&lt;br /&gt;
In the Cluster configuration tab you can configure the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; at the very top. &lt;br /&gt;
This level controls how many redundant copies of each packet are written. &lt;br /&gt;
No replication means that only a single copy of each packet is written and provides no redundancy. &lt;br /&gt;
This level gives the highest write bandwidth for a given number of disks; single replication means that one additional copy of each packet is written to some other disk and thus reduces the total write performance for a given number of disks to half the performance of no replication. &lt;br /&gt;
Double replication and triple replication write two and three additional copies of each packet respectively. &lt;br /&gt;
Note that for each level to work there must be at least the number of replications + 1 disks available in the cluster.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster3.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Below the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; setting is the list of all disks available for use in the cluster. &lt;br /&gt;
The following columns are displayed in the list:&lt;br /&gt;
* Disk: A description of the disk and its capacity.&lt;br /&gt;
* Enclosure: If the disk is part of a multi-disk enclosure this column will show the enclosure number along with the slot number.&lt;br /&gt;
* Status: If the disk has been added to the cluster this column will display the current status as &#039;&#039;&#039;ok&#039;&#039;&#039; or &#039;&#039;&#039;failed&#039;&#039;&#039;. If multiple cluster packet ring buffers are used this will also show if the disk is active in another cluster.&lt;br /&gt;
* Locator: For disks in a multi-disk enclosure the button displayed in this column allows to turn the slot locator LED on and off. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
In the last unlabelled column, three buttons are displayed which have the following functionality:&lt;br /&gt;
* Add to cluster: Add a fresh disk to the cluster. &lt;br /&gt;
:The disk will be formatted and added as empty storage to the cluster. All previous data on the disk is lost.&lt;br /&gt;
* Resume in cluster: If the disk was previously part of a cluster it can be resumed. &lt;br /&gt;
:The data on that disk is now part of the packet ring buffer.&lt;br /&gt;
* Remove from cluster: Remove the disk from the ring buffer. &lt;br /&gt;
:The data stored on that disk is no longer not part of the packet ring buffer but the data is not removed from the disk. It can be resumed in the cluster at a later time.&lt;br /&gt;
&lt;br /&gt;
:If a disk is missing because it was e.g. removed from the enclosure, it will be displayed in a separate list with much of the information as in the list described above but only one button with the option to remove it from the cluster packet ring buffer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster4.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Packet ring buffer snapshot length filter ====&lt;br /&gt;
Rules can be configured that control the snapshot length of each packet which will be stored in the packet ring buffer. &lt;br /&gt;
These rules can also be used to prevent certain packets from being stored in the packet ring buffer. &lt;br /&gt;
This allows to fine tune how much packet data needs to be written to the packet ring buffer. &lt;br /&gt;
The information about the original length of a packet will still be available in captures except when the packet was not written to the packet ring buffer at all (e.g. due to a &#039;&#039;&#039;discard&#039;&#039;&#039; rule). &lt;br /&gt;
&lt;br /&gt;
These rules can be created, edited, deleted, moved up and moved down in the rules list by using the respective buttons.&lt;br /&gt;
&lt;br /&gt;
Evaluation of the rules takes place in the order of the rules as displayed in the rules list from top to bottom. &lt;br /&gt;
The first rule that matches for a given packet will be applied and no further rules will be evaluated for that packet. &lt;br /&gt;
This means that the most generic rule should be at the bottom of the list (like e.g. ‘all packets will be discarded’) and more specific rules should be higher up in the list (like e.g ‘packets with an IP matching 192.168.1.0/24 will be fully captured’).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
When creating a snapshot length filter rule, a dialogue is displayed and allows the following options:&lt;br /&gt;
* Rule condition: Specify which packets to match.&lt;br /&gt;
&lt;br /&gt;
:The input field below allows entering the corresponding value.&lt;br /&gt;
&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Rule condition&lt;br /&gt;
! description&lt;br /&gt;
|-&lt;br /&gt;
| All packets&lt;br /&gt;
| everything&lt;br /&gt;
|-&lt;br /&gt;
| MAC address&lt;br /&gt;
| source or destination MAC address&lt;br /&gt;
|-&lt;br /&gt;
| IP address&lt;br /&gt;
| source or destination IP address or subnet&lt;br /&gt;
|-&lt;br /&gt;
| TCP port&lt;br /&gt;
| the source or destination TCP port&lt;br /&gt;
|-&lt;br /&gt;
| UDP port&lt;br /&gt;
| the source or destination UDP port&lt;br /&gt;
|-&lt;br /&gt;
| Layer 7 protocol&lt;br /&gt;
| the selected Layer 7 protocol&lt;br /&gt;
|-&lt;br /&gt;
| outer VLAN tag&lt;br /&gt;
| the most outer VLAN tag (directly after Ethernet header) &lt;br /&gt;
|-&lt;br /&gt;
| interface&lt;br /&gt;
| the ingress interface the packet originated from&lt;br /&gt;
|-&lt;br /&gt;
| SIP phone number&lt;br /&gt;
|&lt;br /&gt;
The number matches part of the &#039;From:&#039; or &#039;To:&#039; entry in a SIP INVITE packet.&lt;br /&gt;
* only the part between &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;lt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; and &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;gt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; of the From/To line is tested.&lt;br /&gt;
* value &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; will match &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller1&amp;quot; &amp;lt;sip:234&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;, but also &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller2&amp;quot; &amp;lt;sip:12345@test&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;&lt;br /&gt;
* to match from the start, use &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;sip:234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Correlating SIP packets for the same Call-ID will match.&lt;br /&gt;
&lt;br /&gt;
The RTP packets correlated to this SIP call will also match.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
| virtual link group&lt;br /&gt;
| the virtual link group the packet belongs to&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Negate: Controls comparison of the rule condition to the value. If this is off, the value must match. &lt;br /&gt;
:If this is on, the value must not match.&lt;br /&gt;
* Action: What shall be done with the matching packets.&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Action !! Description&lt;br /&gt;
|-&lt;br /&gt;
| Snapshot length&lt;br /&gt;
| The packet is captured with a max length as specified in the input field below. If the packet is larger, the remaining bytes will be discarded.&lt;br /&gt;
|-&lt;br /&gt;
| Discard&lt;br /&gt;
| Discard the whole packet.&lt;br /&gt;
|-&lt;br /&gt;
| Full&lt;br /&gt;
| The entire packet is captured.&lt;br /&gt;
|-&lt;br /&gt;
| Header + data&lt;br /&gt;
|&lt;br /&gt;
Capture just certain parts of the packet.&lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 header&#039;&#039;&#039;, Layer 2 and Layer 3 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 header&#039;&#039;&#039;, Layer 2, 3 and 4 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 + L7 data&#039;&#039;&#039;, an input field is shown where the length of Layer 7 data can be configured.  In this case Layers 2, 3 and 4 are stored together with the specified amount of Layer 7 data.&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Analyzing the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is activated, it is possible to restart the packet processing core and analyze all packets contained in the packet ring buffer. &lt;br /&gt;
When the Analyze packet ring buffer button is pressed, a dialogue will appear which allows you to choose the time range of the packet ring buffer which is to be replayed. &lt;br /&gt;
After confirming this dialogue, the Network Multimeter will reset all statistics and start analyzing the contents of the packet ring buffer. &lt;br /&gt;
Progress, statistics and the option to resume normal operation will appear on the Packet ring buffer page.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== Extracting the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is active, the entire contents can be extracted by capturing the complete timespan that is contained within. &lt;br /&gt;
For convenience, a button labelled Extract packet ring buffer is available that opens the capture dialogue with the start time and end time set to the appropriate values.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3052</id>
		<title>Packet ring buffer</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3052"/>
		<updated>2020-10-09T10:19:38Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Packet ring buffer==&lt;br /&gt;
The ring buffer feature allows to create a buffer of fixed size on an external storage device to which all processed packets will be recorded. &lt;br /&gt;
If the fixed size buffer is full then the oldest packets in the buffer will be replaced with new packets in a round-robin fashion. &lt;br /&gt;
If the feature is not enabled a button titled &#039;&#039;&#039;Create ring buffer&#039;&#039;&#039; is visible. &lt;br /&gt;
Upon clicking on it a dialogue will be displayed and allows you to specify the size of the ring buffer. &lt;br /&gt;
It must be ensured that enough space is available on the external storage device. &lt;br /&gt;
As soon as the ring buffer has been created statistics about the ring buffer will be displayed instead of the button:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer1.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
* Timestamp of oldest packet: The timestamp of the oldest packet in the ring buffer.&lt;br /&gt;
&lt;br /&gt;
* Total size: The total size of the ring buffer on the external storage device. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication an adjusted value is displayed to reflect the redundant copies of packet data. &lt;br /&gt;
:The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
&lt;br /&gt;
* Used size: The currently used amount of memory in the capture buffer. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication an adjusted value is displayed to reflect the redundant copies of packet data. The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
* Overall bytes captured since start: The amount of captured bytes since system start. &lt;br /&gt;
:This may be smaller than the used size if the system has been restarted. And it may be larger than the used size in case the ring buffer is full. &lt;br /&gt;
:The history graph shows the captured traffic of the last minute or in the selected interval (if set).&lt;br /&gt;
* Bytes dropped since start: The traffic which was processed but could not be written to the ring buffer since the start of processing. &lt;br /&gt;
:This is usually an indicator that writes to the external storage device were not fast enough.  The history graph shows the drops over time.&lt;br /&gt;
* Bytes discarded due to snapshot length rules since start: The traffic which matched the snapshot length rules criteria and was not written to the ring buffer. &lt;br /&gt;
:The history graph shows discarding over time.&lt;br /&gt;
* Data in flight: The amount of data which is currently stored in the queue that holds processed packets before they are written to the packet ring buffer. &lt;br /&gt;
:If larger bursts of traffic need to be stored in this queue the size can be modified in the capture module settings.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer2.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
When the ring buffer is full and old packets are deleted, the graphs will show the time range with no data with a dark grey background colour. &lt;br /&gt;
The time range before start of the ring buffer will be visualized in the same way.&lt;br /&gt;
When the ring buffer is running, the behaviour of the pcap capture buttons throughout the system changes: if the user interface is in live mode and a capture is started, a dialogue will appear asking you to specify from how far back in time the capture should start. &lt;br /&gt;
This way it is possible to e.g. capture the traffic of an IP address starting from an hour ago. &lt;br /&gt;
The capture will also continue with live traffic. &lt;br /&gt;
If the user interface is in &#039;&#039;&#039;back-in-time&#039;&#039;&#039; mode (a timespan from the past is selected) starting a capture will produce a dialogue asking to confirm that the capture will cover exactly the timespan selected. &lt;br /&gt;
The capture will automatically stop after the selected timespan has been processed. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer3.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Cluster ring buffer ==== &lt;br /&gt;
The cluster ring buffer feature allows to use multiple whole disks in parallel for a single packet ring buffer. &lt;br /&gt;
It also allows you to optionally write redundant copies of packets to multiple disks to provide fault tolerance in case of a disk failure.&lt;br /&gt;
&lt;br /&gt;
It is also possible to create multiple cluster packet ring buffers that&lt;br /&gt;
run in parallel. To enable multiple cluster packet ring buffers, the&lt;br /&gt;
option `The maximum number of concurrent packet ring buffers` in the&lt;br /&gt;
capture module options can be set to the required number.&lt;br /&gt;
&lt;br /&gt;
When clicking the &#039;&#039;&#039;Create cluster ring buffer&#039;&#039;&#039; button, an empty cluster ring buffer will be created and the &#039;&#039;&#039;Cluster configuration&#039;&#039;&#039; tab on the now visible packet ring buffer statistics page becomes available. &lt;br /&gt;
&lt;br /&gt;
If multiple cluster packet ring buffers are used, the page will show&lt;br /&gt;
a number of buttons at the top to switch between the different clusters.&lt;br /&gt;
Each cluster has its own statistics and configuration.&lt;br /&gt;
&lt;br /&gt;
In the Cluster configuration tab you can configure the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; at the very top. &lt;br /&gt;
This level controls how many redundant copies of each packet are written. &lt;br /&gt;
No replication means that only a single copy of each packet is written and provides no redundancy. &lt;br /&gt;
This level gives the highest write bandwidth for a given number of disks; single replication means that one additional copy of each packet is written to some other disk and thus reduces the total write performance for a given number of disks to half the performance of no replication. &lt;br /&gt;
Double replication and triple replication write two and three additional copies of each packet respectively. &lt;br /&gt;
Note that for each level to work there must be at least the number of replications + 1 disks available in the cluster.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster3.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Below the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; setting is the list of all disks available for use in the cluster. &lt;br /&gt;
The following columns are displayed in the list:&lt;br /&gt;
* Disk: A description of the disk and its capacity.&lt;br /&gt;
* Enclosure: If the disk is part of a multi-disk enclosure this column will show the enclosure number along with the slot number.&lt;br /&gt;
* Status: If the disk has been added to the cluster this column will display the current status as &#039;&#039;&#039;ok&#039;&#039;&#039; or &#039;&#039;&#039;failed&#039;&#039;&#039;. If multiple cluster packet ring buffers are used this will also show if the disk is active in another cluster.&lt;br /&gt;
* Locator: For disks in a multi-disk enclosure the button displayed in this column allows to turn the slot locator LED on and off. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
In the last unlabelled column, three buttons are displayed which have the following functionality:&lt;br /&gt;
* Add to cluster: Add a fresh disk to the cluster. &lt;br /&gt;
:The disk will be formatted and added as empty storage to the cluster. All previous data on the disk is lost.&lt;br /&gt;
* Resume in cluster: If the disk was previously part of a cluster it can be resumed. &lt;br /&gt;
:The data on that disk is now part of the packet ring buffer.&lt;br /&gt;
* Remove from cluster: Remove the disk from the ring buffer. &lt;br /&gt;
:The data stored on that disk is no longer not part of the packet ring buffer but the data is not removed from the disk. It can be resumed in the cluster at a later time.&lt;br /&gt;
&lt;br /&gt;
:If a disk is missing because it was e.g. removed from the enclosure, it will be displayed in a separate list with much of the information as in the list described above but only one button with the option to remove it from the cluster packet ring buffer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster4.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Packet ring buffer snapshot length filter ====&lt;br /&gt;
Rules can be configured that control the snapshot length of each packet which will be stored in the packet ring buffer. &lt;br /&gt;
These rules can also be used to prevent certain packets from being stored in the packet ring buffer. &lt;br /&gt;
This allows to fine tune how much packet data needs to be written to the packet ring buffer. &lt;br /&gt;
The information about the original length of a packet will still be available in captures except when the packet was not written to the packet ring buffer at all (e.g. due to a &#039;&#039;&#039;discard&#039;&#039;&#039; rule). &lt;br /&gt;
&lt;br /&gt;
These rules can be created, edited, deleted, moved up and moved down in the rules list by using the respective buttons.&lt;br /&gt;
&lt;br /&gt;
Evaluation of the rules takes place in the order of the rules as displayed in the rules list from top to bottom. &lt;br /&gt;
The first rule that matches for a given packet will be applied and no further rules will be evaluated for that packet. &lt;br /&gt;
This means that the most generic rule should be at the bottom of the list (like e.g. ‘all packets will be discarded’) and more specific rules should be higher up in the list (like e.g ‘packets with an IP matching 192.168.1.0/24 will be fully captured’).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
When creating a snapshot length filter rule, a dialogue is displayed and allows the following options:&lt;br /&gt;
* Rule condition: Specify which packets to match.&lt;br /&gt;
&lt;br /&gt;
:The input field below allows entering the corresponding value.&lt;br /&gt;
&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Rule condition&lt;br /&gt;
! description&lt;br /&gt;
|-&lt;br /&gt;
| All packets&lt;br /&gt;
| everything&lt;br /&gt;
|-&lt;br /&gt;
| MAC address&lt;br /&gt;
| source or destination MAC address&lt;br /&gt;
|-&lt;br /&gt;
| IP address&lt;br /&gt;
| source or destination IP address or subnet&lt;br /&gt;
|-&lt;br /&gt;
| TCP port&lt;br /&gt;
| the source or destination TCP port&lt;br /&gt;
|-&lt;br /&gt;
| UDP port&lt;br /&gt;
| the source or destination UDP port&lt;br /&gt;
|-&lt;br /&gt;
| Layer 7 protocol&lt;br /&gt;
| the selected Layer 7 protocol&lt;br /&gt;
|-&lt;br /&gt;
| outer VLAN tag&lt;br /&gt;
| the most outer VLAN tag (directly after Ethernet header) &lt;br /&gt;
|-&lt;br /&gt;
| interface&lt;br /&gt;
| the ingress interface the packet originated from&lt;br /&gt;
|-&lt;br /&gt;
| SIP phone number&lt;br /&gt;
|&lt;br /&gt;
The number matches part of the &#039;From:&#039; or &#039;To:&#039; entry in a SIP INVITE packet.&lt;br /&gt;
* only the part between &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;lt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; and &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;gt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; of the From/To line is tested.&lt;br /&gt;
* value &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; will match &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller1&amp;quot; &amp;lt;sip:234&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;, but also &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller2&amp;quot; &amp;lt;sip:12345@test&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;&lt;br /&gt;
* to match from the start, use &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;sip:234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Correlating SIP packets for the same Call-ID will match.&lt;br /&gt;
&lt;br /&gt;
The RTP packets correlated to this SIP call will also match.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
| virtual link group&lt;br /&gt;
| the virtual link group the packet belongs to&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Negate: Controls comparison of the rule condition to the value. If this is off, the value must match. &lt;br /&gt;
:If this is on, the value must not match.&lt;br /&gt;
* Action: What shall be done with the matching packets.&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Action !! Description&lt;br /&gt;
|-&lt;br /&gt;
| Snapshot length&lt;br /&gt;
| The packet is captured with a max length as specified in the input field below. If the packet is larger, the remaining bytes will be discarded.&lt;br /&gt;
|-&lt;br /&gt;
| Discard&lt;br /&gt;
| Discard the whole packet.&lt;br /&gt;
|-&lt;br /&gt;
| Full&lt;br /&gt;
| The entire packet is captured.&lt;br /&gt;
|-&lt;br /&gt;
| Header + data&lt;br /&gt;
|&lt;br /&gt;
Capture just certain parts of the packet.&lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 header&#039;&#039;&#039;, Layer 2 and Layer 3 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 header&#039;&#039;&#039;, Layer 2, 3 and 4 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 + L7 data&#039;&#039;&#039;, an input field is shown where the length of Layer 7 data can be configured.  In this case Layers 2, 3 and 4 are stored together with the specified amount of Layer 7 data.&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Analyzing the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is activated, it is possible to restart the packet processing core and analyze all packets contained in the packet ring buffer. &lt;br /&gt;
When the Analyze packet ring buffer button is pressed, a dialogue will appear which allows you to choose the time range of the packet ring buffer which is to be replayed. &lt;br /&gt;
After confirming this dialogue, the Network Multimeter will reset all statistics and start analyzing the contents of the packet ring buffer. &lt;br /&gt;
Progress, statistics and the option to resume normal operation will appear on the Packet ring buffer page.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== Extracting the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is active, the entire contents can be extracted by capturing the complete timespan that is contained within. &lt;br /&gt;
For convenience, a button labelled Extract packet ring buffer is available that opens the capture dialogue with the start time and end time set to the appropriate values.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3051</id>
		<title>Packet ring buffer</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3051"/>
		<updated>2020-10-09T10:14:07Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Packet ring buffer==&lt;br /&gt;
The ring buffer feature allows to create a buffer of fixed size on an external storage device to which all processed packets will be recorded. &lt;br /&gt;
If the fixed size buffer is full then the oldest packets in the buffer will be replaced with new packets in a round-robin fashion. &lt;br /&gt;
If the feature is not enabled a button titled &#039;&#039;&#039;Create ring buffer&#039;&#039;&#039; is visible. &lt;br /&gt;
Upon clicking on it a dialogue will be displayed and allows you to specify the size of the ring buffer. &lt;br /&gt;
It must be ensured that enough space is available on the external storage device. &lt;br /&gt;
As soon as the ring buffer has been created statistics about the ring buffer will be displayed instead of the button:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer1.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
* Timestamp of oldest packet: The timestamp of the oldest packet in the ring buffer.&lt;br /&gt;
&lt;br /&gt;
* Total size: The total size of the ring buffer on the external storage device. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication an adjusted value is displayed to reflect the redundant copies of packet data. &lt;br /&gt;
:The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
&lt;br /&gt;
* Used size: The currently used amount of memory in the capture buffer. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication an adjusted value is displayed to reflect the redundant copies of packet data. The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
* Overall bytes captured since start: The amount of captured bytes since system start. &lt;br /&gt;
:This may be smaller than the used size if the system has been restarted. And it may be larger than the used size in case the ring buffer is full. &lt;br /&gt;
:The history graph shows the captured traffic of the last minute or in the selected interval (if set).&lt;br /&gt;
* Bytes dropped since start: The traffic which was processed but could not be written to the ring buffer since the start of processing. &lt;br /&gt;
:This is usually an indicator that writes to the external storage device were not fast enough.  The history graph shows the drops over time.&lt;br /&gt;
* Bytes discarded due to snapshot length rules since start: The traffic which matched the snapshot length rules criteria and was not written to the ring buffer. &lt;br /&gt;
:The history graph shows discarding over time.&lt;br /&gt;
* Data in flight: The amount of data which is currently stored in the queue that holds processed packets before they are written to the packet ring buffer. &lt;br /&gt;
:If larger bursts of traffic need to be stored in this queue the size can be modified in the capture module settings.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer2.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
When the ring buffer is full and old packets are deleted, the graphs will show the time range with no data with a dark grey background colour. &lt;br /&gt;
The time range before start of the ring buffer will be visualized in the same way.&lt;br /&gt;
When the ring buffer is running, the behaviour of the pcap capture buttons throughout the system changes: if the user interface is in live mode and a capture is started, a dialogue will appear asking you to specify from how far back in time the capture should start. &lt;br /&gt;
This way it is possible to e.g. capture the traffic of an IP address starting from an hour ago. &lt;br /&gt;
The capture will also continue with live traffic. &lt;br /&gt;
If the user interface is in &#039;&#039;&#039;back-in-time&#039;&#039;&#039; mode (a timespan from the past is selected) starting a capture will produce a dialogue asking to confirm that the capture will cover exactly the timespan selected. &lt;br /&gt;
The capture will automatically stop after the selected timespan has been processed. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer3.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Cluster ring buffer ==== &lt;br /&gt;
The cluster ring buffer feature allows to use multiple whole disks in parallel for a single packet ring buffer. &lt;br /&gt;
It also allows you to optionally write redundant copies of packets to multiple disks to provide fault tolerance in case of a disk failure.&lt;br /&gt;
&lt;br /&gt;
It is also possible to create multiple cluster packet ring buffers that&lt;br /&gt;
run in parallel. To enable multiple cluster packet ring buffers, the&lt;br /&gt;
option `The maximum number of concurrent packet ring buffers` in the&lt;br /&gt;
capture module options can be set to the required number.&lt;br /&gt;
&lt;br /&gt;
When clicking the &#039;&#039;&#039;Create cluster ring buffer&#039;&#039;&#039; button, an empty cluster ring buffer will be created and the &#039;&#039;&#039;Cluster configuration&#039;&#039;&#039; tab on the now visible packet ring buffer statistics page becomes available. &lt;br /&gt;
&lt;br /&gt;
If multiple cluster packet ring buffers are used, the page will show&lt;br /&gt;
a number of buttons at the top to switch between the different clusters.&lt;br /&gt;
Each cluster has its own statistics and configuration.&lt;br /&gt;
&lt;br /&gt;
In the Cluster configuration tab you can configure the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; at the very top. &lt;br /&gt;
This level controls how many redundant copies of each packet are written. &lt;br /&gt;
No replication means that only a single copy of each packet is written and provides no redundancy. &lt;br /&gt;
This level gives the highest write bandwidth for a given number of disks; single replication means that one additional copy of each packet is written to some other disk and thus reduces the total write performance for a given number of disks to half the performance of no replication. &lt;br /&gt;
Double replication and triple replication write two and three additional copies of each packet respectively. &lt;br /&gt;
Note that for each level to work there must be at least the number of replications + 1 disks available in the cluster.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster3.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Below the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; setting is the list of all disks available for use in the cluster. &lt;br /&gt;
The following columns are displayed in the list:&lt;br /&gt;
* Disk: A description of the disk and its capacity.&lt;br /&gt;
* Enclosure: If the disk is part of a multi-disk enclosure this column will show the enclosure number along with the slot number.&lt;br /&gt;
* Status: If the disk has been added to the cluster this column will display the current status as &#039;&#039;&#039;ok&#039;&#039;&#039; or &#039;&#039;&#039;failed&#039;&#039;&#039;. If multiple cluster packet ring buffers are used this will also show if the disk is active in another cluster.&lt;br /&gt;
* Locator: For disks in a multi-disk enclosure the button displayed in this column allows to turn the slot locator LED on and off. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
In the last unlabelled column, three buttons are displayed which have the following functionality:&lt;br /&gt;
* Add to cluster: Add a fresh disk to the cluster. &lt;br /&gt;
:The disk will be formatted and added as empty storage to the cluster. All previous data on the disk is lost.&lt;br /&gt;
* Resume in cluster: If the disk was previously part of a cluster it can be resumed. &lt;br /&gt;
:The data on that disk is now part of the packet ring buffer.&lt;br /&gt;
* Remove from cluster: Remove the disk from the ring buffer. &lt;br /&gt;
:The data stored on that disk is not part of the packet ring buffer anymore but the data is not removed from the disk. It can be resumed in the cluster at a later time.&lt;br /&gt;
&lt;br /&gt;
:If a disk is missing because it was e.g. removed from the enclosure it will be displayed in a separate list with much of the information as in the list described above but only one button with the option to remove it from the cluster packet ring buffer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster4.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Packet ring buffer snapshot length filter ====&lt;br /&gt;
Rules can be configured that control the snapshot length of each packet which shall be stored in the packet ring buffer. &lt;br /&gt;
These rules can also be used to prevent certain packets from being stored in the packet ring buffer. &lt;br /&gt;
This allows to fine tune how much packet data needs to be written to the packet ring buffer. &lt;br /&gt;
The information about the original length of a packet will still be available in captures except when the packet was not written to the packet ring buffer at all (e.g. due to a &#039;&#039;&#039;discard&#039;&#039;&#039; rule). &lt;br /&gt;
&lt;br /&gt;
These rules can be created, edited, deleted, moved up and moved down in the rules list by using the respective buttons.&lt;br /&gt;
&lt;br /&gt;
Evaluation of the rules takes place in the order of the rules as displayed in the rules list from top to bottom. &lt;br /&gt;
The first rule that matches for a given packet will be applied and no further rules will be evaluated for that packet. &lt;br /&gt;
This means that the most generic rule should be at the bottom of the list (like e.g. ‘all packets will be discarded’) and more specific rules should be higher up in the list (like e.g ‘packets with an IP matching 192.168.1.0/24 will be fully captured’).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
When creating a snapshot length filter rule, a dialog is displayed and allows following options:&lt;br /&gt;
* Rule condition: Specify which packets to match.&lt;br /&gt;
&lt;br /&gt;
:The input field below allows entering the corresponding value.&lt;br /&gt;
&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Rule condition&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| All packets&lt;br /&gt;
| everything&lt;br /&gt;
|-&lt;br /&gt;
| MAC address&lt;br /&gt;
| source or destination MAC address&lt;br /&gt;
|-&lt;br /&gt;
| IP address&lt;br /&gt;
| source or destination IP address or subnet&lt;br /&gt;
|-&lt;br /&gt;
| TCP port&lt;br /&gt;
| the source or destination TCP port&lt;br /&gt;
|-&lt;br /&gt;
| UDP port&lt;br /&gt;
| the source or destination UDP port&lt;br /&gt;
|-&lt;br /&gt;
| Layer 7 protocol&lt;br /&gt;
| the selected layer 7 protocol&lt;br /&gt;
|-&lt;br /&gt;
| outer VLAN tag&lt;br /&gt;
| the most outer VLAN tag (directly after ethernet header) &lt;br /&gt;
|-&lt;br /&gt;
| interface&lt;br /&gt;
| the ingress interface the packet originated from&lt;br /&gt;
|-&lt;br /&gt;
| SIP phone number&lt;br /&gt;
|&lt;br /&gt;
The number matches part of the &#039;From:&#039; or &#039;To:&#039; entry in a SIP INVITE packet.&lt;br /&gt;
* only the part between &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;lt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; and &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;gt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; of the From/To line is tested.&lt;br /&gt;
* value &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; will match &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller1&amp;quot; &amp;lt;sip:234&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;, but also &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller2&amp;quot; &amp;lt;sip:12345@test&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;&lt;br /&gt;
* to match from the start, use &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;sip:234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Correlating SIP packets for the same Call-ID will match.&lt;br /&gt;
&lt;br /&gt;
The RTP packets correlated to this SIP call will also match.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
| virtual link group&lt;br /&gt;
| the virtual link group the packet belongs to&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Negate: Controls comparison of the rule condition to the value. If this is off, the value must match. &lt;br /&gt;
:If this is on, the value must not match.&lt;br /&gt;
* Action: What shall be done with the matching packets.&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Action !! Description&lt;br /&gt;
|-&lt;br /&gt;
| Snapshot length&lt;br /&gt;
| The packet is captured with a max length as specified in the input field below. If the packet is larger, the remaining bytes will be discarded.&lt;br /&gt;
|-&lt;br /&gt;
| Discard&lt;br /&gt;
| Discard the whole packet.&lt;br /&gt;
|-&lt;br /&gt;
| Full&lt;br /&gt;
| The whole packet is captured.&lt;br /&gt;
|-&lt;br /&gt;
| Header + data&lt;br /&gt;
|&lt;br /&gt;
Capture just certain parts of the packet.&lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 header&#039;&#039;&#039;, layer 2 and layer 3 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 header&#039;&#039;&#039;, layer 2, 3 and 4 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 + L7 data&#039;&#039;&#039;, an input field is shown where the length of layer 7 data can be configured.  In this case layer 2, 3 and 4 are stored together with the specified amount of layer 7 data.&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Analyzing the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is activated it is possible to restart the packet processing core and analyze all packets contained in the packet ring buffer. &lt;br /&gt;
When the Analyze packet ring buffer button is pressed a dialog will appear which allows to choose the time range of the packet ring buffer which is to be replayed. &lt;br /&gt;
After confirming this dialog the Network Multimeter will reset all statistics and start analyzing the contents of the packet ring buffer. &lt;br /&gt;
Progress, statistics and the option to resume normal operation will appear on the Packet ring buffer page.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== Extracting the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is active the complete contents of it can be extracted by capturing the complete timespan that is contained within. &lt;br /&gt;
For convenience a button labeled Extract packet ring buffer is available that opens the capture dialog with the start time and end time set to the appropriate values.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3050</id>
		<title>Packet ring buffer</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3050"/>
		<updated>2020-10-09T10:10:53Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Packet ring buffer==&lt;br /&gt;
The ring buffer feature allows to create a buffer of fixed size on an external storage device to which all processed packets will be recorded. &lt;br /&gt;
If the fixed size buffer is full then the oldest packets in the buffer will be replaced with new packets in a round-robin fashion. &lt;br /&gt;
If the feature is not enabled a button titled &#039;&#039;&#039;Create ring buffer&#039;&#039;&#039; is visible. &lt;br /&gt;
Upon clicking on it a dialogue will be displayed and allows you to specify the size of the ring buffer. &lt;br /&gt;
It must be ensured that enough space is available on the external storage device. &lt;br /&gt;
As soon as the ring buffer has been created statistics about the ring buffer will be displayed instead of the button:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer1.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
* Timestamp of oldest packet: The timestamp of the oldest packet in the ring buffer.&lt;br /&gt;
&lt;br /&gt;
* Total size: The total size of the ring buffer on the external storage device. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication an adjusted value is displayed to reflect the redundant copies of packet data. &lt;br /&gt;
:The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
&lt;br /&gt;
* Used size: The currently used amount of memory in the capture buffer. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication an adjusted value is displayed to reflect the redundant copies of packet data. The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
* Overall bytes captured since start: The amount of captured bytes since system start. &lt;br /&gt;
:This may be smaller than the used size if the system has been restarted. And it may be larger than the used size in case the ring buffer is full. &lt;br /&gt;
:The history graph shows the captured traffic of the last minute or in the selected interval (if set).&lt;br /&gt;
* Bytes dropped since start: The traffic which was processed but could not be written to the ring buffer since the start of processing. &lt;br /&gt;
:This is usually an indicator that writes to the external storage device were not fast enough.  The history graph shows the drops over time.&lt;br /&gt;
* Bytes discarded due to snapshot length rules since start: The traffic which matched the snapshot length rules criteria and was not written to the ring buffer. &lt;br /&gt;
:The history graph shows discarding over time.&lt;br /&gt;
* Data in flight: The amount of data which is currently stored in the queue that holds processed packets before they are written to the packet ring buffer. &lt;br /&gt;
:If larger bursts of traffic need to be stored in this queue the size can be modified in the capture module settings.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer2.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
When the ring buffer is full and old packets are deleted, the graphs will show the time range with no data with a dark grey background colour. &lt;br /&gt;
The time range before start of the ring buffer will be visualized in the same way.&lt;br /&gt;
When the ring buffer is running, the behaviour of the pcap capture buttons throughout the system changes: if the user interface is in live mode and a capture is started, a dialogue will appear asking you to specify from how far back in time the capture should start. &lt;br /&gt;
This way it is possible to e.g. capture the traffic of an IP address starting from an hour ago. &lt;br /&gt;
The capture will also continue with live traffic. &lt;br /&gt;
If the user interface is in &#039;&#039;&#039;back-in-time&#039;&#039;&#039; mode (a timespan from the past is selected) starting a capture will produce a dialogue asking to confirm that the capture will cover exactly the timespan selected. &lt;br /&gt;
The capture will automatically stop after the selected timespan has been processed. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer3.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Cluster ring buffer ==== &lt;br /&gt;
The cluster ring buffer feature allows to use multiple whole disks in parallel for a single packet ring buffer. &lt;br /&gt;
It also allows to optionally write redundant copies of packets to multiple disks to provide fault tolerance in case of a disk failure.&lt;br /&gt;
&lt;br /&gt;
It is also possible to create multiple cluster packet ring buffers that&lt;br /&gt;
run in parallel. To enable multiple cluster packet ring buffers the&lt;br /&gt;
option `The maximum number of concurrent packet ring buffers` in the&lt;br /&gt;
capture module options can be set to the required number.&lt;br /&gt;
&lt;br /&gt;
When clicking the &#039;&#039;&#039;Create cluster ring buffer&#039;&#039;&#039; button an empty cluster ring buffer will be created and the &#039;&#039;&#039;Cluster configuration&#039;&#039;&#039; tab on the now visible packet ring buffer statistics page becomes available. &lt;br /&gt;
&lt;br /&gt;
If multiple cluster packet ring buffers are used the page will show&lt;br /&gt;
a number of buttons at the top to switch between the different clusters.&lt;br /&gt;
Each cluster has it&#039;s own statistics and configuration.&lt;br /&gt;
&lt;br /&gt;
In the Cluster configuration tab you can configure the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; at the very top. &lt;br /&gt;
This level controls how many redundant copies of each packet are written. &lt;br /&gt;
no replication means, that only a single copy of each packet is written and provides no redundancy. &lt;br /&gt;
This level gives the highest write bandwidth for a given number of disks. single replication means that one additional copy of each packet is written to some other disk and thus reduces the total write performance for a given number of disk to half the performance of no replication. &lt;br /&gt;
double replication and triple replication write two and three additional copies of each packet respectively. &lt;br /&gt;
Note that for each level to work there must be at least the number of replications + 1 disks available in the cluster.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster3.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Below the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; setting is the list of all disks available for use in the cluster. &lt;br /&gt;
Following columns are displayed in the list:&lt;br /&gt;
* Disk: A description of the disk and its capacity.&lt;br /&gt;
* Enclosure: If the disk is part of a multi-disk enclosure this column will show the enclosure number along with the slot number.&lt;br /&gt;
* Status: If the disk has been added to the cluster this column will display the current status as &#039;&#039;&#039;ok&#039;&#039;&#039; or &#039;&#039;&#039;failed&#039;&#039;&#039;. If multiple cluster packet ring buffers are used this will also show if the disk is active in another cluster.&lt;br /&gt;
* Locator: For disks in a multi-disk enclosure the button displayed in this column allows to turn the slot locator LED on and off. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
In the last unlabeled column there are three buttons displayed which have the following functionality:&lt;br /&gt;
* Add to cluster: Add a fresh disk to the cluster. &lt;br /&gt;
:The disk will be formatted and added as empty storage to the cluster. All previous data on the disk is lost.&lt;br /&gt;
* Resume in cluster: If the disk was previously part of a cluster it can be resumed. &lt;br /&gt;
:The data on that disk is now part of the packet ring buffer.&lt;br /&gt;
* Remove from cluster: Remove the disk from the ring buffer. &lt;br /&gt;
:The data stored on that disk is not part of the packet ring buffer anymore but the data is not removed from the disk. It can be resumed in the cluster at a later time.&lt;br /&gt;
&lt;br /&gt;
:If a disk is missing because it was e.g. removed from the enclosure it will be displayed in a separate list with much of the information as in the list described above but only one button with the option to remove it from the cluster packet ring buffer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster4.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Packet ring buffer snapshot length filter ====&lt;br /&gt;
Rules can be configured that control the snapshot length of each packet which shall be stored in the packet ring buffer. &lt;br /&gt;
These rules can also be used to prevent certain packets from being stored in the packet ring buffer. &lt;br /&gt;
This allows to fine tune how much packet data needs to be written to the packet ring buffer. &lt;br /&gt;
The information about the original length of a packet will still be available in captures except when the packet was not written to the packet ring buffer at all (e.g. due to a &#039;&#039;&#039;discard&#039;&#039;&#039; rule). &lt;br /&gt;
&lt;br /&gt;
These rules can be created, edited, deleted, moved up and moved down in the rules list by using the respective buttons.&lt;br /&gt;
&lt;br /&gt;
Evaluation of the rules takes place in the order of the rules as displayed in the rules list from top to bottom. &lt;br /&gt;
The first rule that matches for a given packet will be applied and no further rules will be evaluated for that packet. &lt;br /&gt;
This means that the most generic rule should be at the bottom of the list (like e.g. ‘all packets will be discarded’) and more specific rules should be higher up in the list (like e.g ‘packets with an IP matching 192.168.1.0/24 will be fully captured’).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
When creating a snapshot length filter rule, a dialog is displayed and allows following options:&lt;br /&gt;
* Rule condition: Specify which packets to match.&lt;br /&gt;
&lt;br /&gt;
:The input field below allows entering the corresponding value.&lt;br /&gt;
&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Rule condition&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| All packets&lt;br /&gt;
| everything&lt;br /&gt;
|-&lt;br /&gt;
| MAC address&lt;br /&gt;
| source or destination MAC address&lt;br /&gt;
|-&lt;br /&gt;
| IP address&lt;br /&gt;
| source or destination IP address or subnet&lt;br /&gt;
|-&lt;br /&gt;
| TCP port&lt;br /&gt;
| the source or destination TCP port&lt;br /&gt;
|-&lt;br /&gt;
| UDP port&lt;br /&gt;
| the source or destination UDP port&lt;br /&gt;
|-&lt;br /&gt;
| Layer 7 protocol&lt;br /&gt;
| the selected layer 7 protocol&lt;br /&gt;
|-&lt;br /&gt;
| outer VLAN tag&lt;br /&gt;
| the most outer VLAN tag (directly after ethernet header) &lt;br /&gt;
|-&lt;br /&gt;
| interface&lt;br /&gt;
| the ingress interface the packet originated from&lt;br /&gt;
|-&lt;br /&gt;
| SIP phone number&lt;br /&gt;
|&lt;br /&gt;
The number matches part of the &#039;From:&#039; or &#039;To:&#039; entry in a SIP INVITE packet.&lt;br /&gt;
* only the part between &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;lt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; and &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;gt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; of the From/To line is tested.&lt;br /&gt;
* value &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; will match &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller1&amp;quot; &amp;lt;sip:234&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;, but also &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller2&amp;quot; &amp;lt;sip:12345@test&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;&lt;br /&gt;
* to match from the start, use &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;sip:234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Correlating SIP packets for the same Call-ID will match.&lt;br /&gt;
&lt;br /&gt;
The RTP packets correlated to this SIP call will also match.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
| virtual link group&lt;br /&gt;
| the virtual link group the packet belongs to&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Negate: Controls comparison of the rule condition to the value. If this is off, the value must match. &lt;br /&gt;
:If this is on, the value must not match.&lt;br /&gt;
* Action: What shall be done with the matching packets.&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Action !! Description&lt;br /&gt;
|-&lt;br /&gt;
| Snapshot length&lt;br /&gt;
| The packet is captured with a max length as specified in the input field below. If the packet is larger, the remaining bytes will be discarded.&lt;br /&gt;
|-&lt;br /&gt;
| Discard&lt;br /&gt;
| Discard the whole packet.&lt;br /&gt;
|-&lt;br /&gt;
| Full&lt;br /&gt;
| The whole packet is captured.&lt;br /&gt;
|-&lt;br /&gt;
| Header + data&lt;br /&gt;
|&lt;br /&gt;
Capture just certain parts of the packet.&lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 header&#039;&#039;&#039;, layer 2 and layer 3 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 header&#039;&#039;&#039;, layer 2, 3 and 4 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 + L7 data&#039;&#039;&#039;, an input field is shown where the length of layer 7 data can be configured.  In this case layer 2, 3 and 4 are stored together with the specified amount of layer 7 data.&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Analyzing the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is activated it is possible to restart the packet processing core and analyze all packets contained in the packet ring buffer. &lt;br /&gt;
When the Analyze packet ring buffer button is pressed a dialog will appear which allows to choose the time range of the packet ring buffer which is to be replayed. &lt;br /&gt;
After confirming this dialog the Network Multimeter will reset all statistics and start analyzing the contents of the packet ring buffer. &lt;br /&gt;
Progress, statistics and the option to resume normal operation will appear on the Packet ring buffer page.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== Extracting the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is active the complete contents of it can be extracted by capturing the complete timespan that is contained within. &lt;br /&gt;
For convenience a button labeled Extract packet ring buffer is available that opens the capture dialog with the start time and end time set to the appropriate values.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3049</id>
		<title>Packet ring buffer</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3049"/>
		<updated>2020-10-09T10:09:11Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Packet ring buffer==&lt;br /&gt;
The ring buffer feature allows to create a buffer of fixed size on an external storage device to which all processed packets will be recorded. &lt;br /&gt;
If the fixed size buffer is full then the oldest packets in the buffer will be replaced with new packets in a round-robin fashion. &lt;br /&gt;
If the feature is not enabled a button titled &#039;&#039;&#039;Create ring buffer&#039;&#039;&#039; is visible. &lt;br /&gt;
Upon clicking on it a dialogue will be displayed and allows you to specify the size of the ring buffer. &lt;br /&gt;
It must be ensured that enough space is available on the external storage device. &lt;br /&gt;
As soon as the ring buffer has been created statistics about the ring buffer will be displayed instead of the button:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer1.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
* Timestamp of oldest packet: The timestamp of the oldest packet in the ring buffer.&lt;br /&gt;
&lt;br /&gt;
* Total size: The total size of the ring buffer on the external storage device. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication an adjusted value is displayed to reflect the redundant copies of packet data. &lt;br /&gt;
:The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
&lt;br /&gt;
* Used size: The currently used amount of memory in the capture buffer. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication an adjusted value is displayed to reflect the redundant copies of packet data. The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
* Overall bytes captured since start: The amount of captured bytes since system start. &lt;br /&gt;
:This may be smaller than the used size if the system has been restarted. And it may be larger than the used size in case the ring buffer is full. &lt;br /&gt;
:The history graph shows the captured traffic of the last minute or in the selected interval (if set).&lt;br /&gt;
* Bytes dropped since start: The traffic which was processed but could not be written to the ring buffer since the start of processing. &lt;br /&gt;
:This is usually an indicator that writes to the external storage device were not fast enough.  The history graph shows the drops over time.&lt;br /&gt;
* Bytes discarded due to snapshot length rules since start: The traffic which matched the snapshot length rules criteria and was not written to the ring buffer. &lt;br /&gt;
:The history graph shows discarding over time.&lt;br /&gt;
* Data in flight: The amount of data which is currently stored in the queue that holds processed packets before they are written to the packet ring buffer. &lt;br /&gt;
:If larger bursts of traffic need to be stored in this queue the size can be modified in the capture module settings.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer2.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
When the ring buffer is full and old packets are deleted, the graphs will show the time range with no data with a dark grey background colour. &lt;br /&gt;
The time range before start of the ring buffer will be visualized in the same way.&lt;br /&gt;
When the ring buffer is running, the behavior of the PCAP capture buttons throughout the system changes: if the user interface is in live mode and a capture is started, a dialog will appear asking to specify from how far back in time the capture should start. &lt;br /&gt;
This way it is possible to e.g. capture the traffic of an IP address starting from an hour ago. &lt;br /&gt;
The capture will also continue with live traffic. &lt;br /&gt;
If the user interface is in &#039;&#039;&#039;back-in-time&#039;&#039;&#039; mode (a timespan from the past is selected) starting a capture will produce a dialog asking to confirm that the capture will cover exactly the timespan selected. &lt;br /&gt;
The capture will automatically stop after the selected timespan has been processed. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer3.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Cluster ring buffer ==== &lt;br /&gt;
The cluster ring buffer feature allows to use multiple whole disks in parallel for a single packet ring buffer. &lt;br /&gt;
It also allows to optionally write redundant copies of packets to multiple disks to provide fault tolerance in case of a disk failure.&lt;br /&gt;
&lt;br /&gt;
It is also possible to create multiple cluster packet ring buffers that&lt;br /&gt;
run in parallel. To enable multiple cluster packet ring buffers the&lt;br /&gt;
option `The maximum number of concurrent packet ring buffers` in the&lt;br /&gt;
capture module options can be set to the required number.&lt;br /&gt;
&lt;br /&gt;
When clicking the &#039;&#039;&#039;Create cluster ring buffer&#039;&#039;&#039; button an empty cluster ring buffer will be created and the &#039;&#039;&#039;Cluster configuration&#039;&#039;&#039; tab on the now visible packet ring buffer statistics page becomes available. &lt;br /&gt;
&lt;br /&gt;
If multiple cluster packet ring buffers are used the page will show&lt;br /&gt;
a number of buttons at the top to switch between the different clusters.&lt;br /&gt;
Each cluster has it&#039;s own statistics and configuration.&lt;br /&gt;
&lt;br /&gt;
In the Cluster configuration tab you can configure the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; at the very top. &lt;br /&gt;
This level controls how many redundant copies of each packet are written. &lt;br /&gt;
no replication means, that only a single copy of each packet is written and provides no redundancy. &lt;br /&gt;
This level gives the highest write bandwidth for a given number of disks. single replication means that one additional copy of each packet is written to some other disk and thus reduces the total write performance for a given number of disk to half the performance of no replication. &lt;br /&gt;
double replication and triple replication write two and three additional copies of each packet respectively. &lt;br /&gt;
Note that for each level to work there must be at least the number of replications + 1 disks available in the cluster.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster3.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Below the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; setting is the list of all disks available for use in the cluster. &lt;br /&gt;
Following columns are displayed in the list:&lt;br /&gt;
* Disk: A description of the disk and its capacity.&lt;br /&gt;
* Enclosure: If the disk is part of a multi-disk enclosure this column will show the enclosure number along with the slot number.&lt;br /&gt;
* Status: If the disk has been added to the cluster this column will display the current status as &#039;&#039;&#039;ok&#039;&#039;&#039; or &#039;&#039;&#039;failed&#039;&#039;&#039;. If multiple cluster packet ring buffers are used this will also show if the disk is active in another cluster.&lt;br /&gt;
* Locator: For disks in a multi-disk enclosure the button displayed in this column allows to turn the slot locator LED on and off. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
In the last unlabeled column there are three buttons displayed which have the following functionality:&lt;br /&gt;
* Add to cluster: Add a fresh disk to the cluster. &lt;br /&gt;
:The disk will be formatted and added as empty storage to the cluster. All previous data on the disk is lost.&lt;br /&gt;
* Resume in cluster: If the disk was previously part of a cluster it can be resumed. &lt;br /&gt;
:The data on that disk is now part of the packet ring buffer.&lt;br /&gt;
* Remove from cluster: Remove the disk from the ring buffer. &lt;br /&gt;
:The data stored on that disk is not part of the packet ring buffer anymore but the data is not removed from the disk. It can be resumed in the cluster at a later time.&lt;br /&gt;
&lt;br /&gt;
:If a disk is missing because it was e.g. removed from the enclosure it will be displayed in a separate list with much of the information as in the list described above but only one button with the option to remove it from the cluster packet ring buffer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster4.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Packet ring buffer snapshot length filter ====&lt;br /&gt;
Rules can be configured that control the snapshot length of each packet which shall be stored in the packet ring buffer. &lt;br /&gt;
These rules can also be used to prevent certain packets from being stored in the packet ring buffer. &lt;br /&gt;
This allows to fine tune how much packet data needs to be written to the packet ring buffer. &lt;br /&gt;
The information about the original length of a packet will still be available in captures except when the packet was not written to the packet ring buffer at all (e.g. due to a &#039;&#039;&#039;discard&#039;&#039;&#039; rule). &lt;br /&gt;
&lt;br /&gt;
These rules can be created, edited, deleted, moved up and moved down in the rules list by using the respective buttons.&lt;br /&gt;
&lt;br /&gt;
Evaluation of the rules takes place in the order of the rules as displayed in the rules list from top to bottom. &lt;br /&gt;
The first rule that matches for a given packet will be applied and no further rules will be evaluated for that packet. &lt;br /&gt;
This means that the most generic rule should be at the bottom of the list (like e.g. ‘all packets will be discarded’) and more specific rules should be higher up in the list (like e.g ‘packets with an IP matching 192.168.1.0/24 will be fully captured’).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
When creating a snapshot length filter rule, a dialog is displayed and allows following options:&lt;br /&gt;
* Rule condition: Specify which packets to match.&lt;br /&gt;
&lt;br /&gt;
:The input field below allows entering the corresponding value.&lt;br /&gt;
&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Rule condition&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| All packets&lt;br /&gt;
| everything&lt;br /&gt;
|-&lt;br /&gt;
| MAC address&lt;br /&gt;
| source or destination MAC address&lt;br /&gt;
|-&lt;br /&gt;
| IP address&lt;br /&gt;
| source or destination IP address or subnet&lt;br /&gt;
|-&lt;br /&gt;
| TCP port&lt;br /&gt;
| the source or destination TCP port&lt;br /&gt;
|-&lt;br /&gt;
| UDP port&lt;br /&gt;
| the source or destination UDP port&lt;br /&gt;
|-&lt;br /&gt;
| Layer 7 protocol&lt;br /&gt;
| the selected layer 7 protocol&lt;br /&gt;
|-&lt;br /&gt;
| outer VLAN tag&lt;br /&gt;
| the most outer VLAN tag (directly after ethernet header) &lt;br /&gt;
|-&lt;br /&gt;
| interface&lt;br /&gt;
| the ingress interface the packet originated from&lt;br /&gt;
|-&lt;br /&gt;
| SIP phone number&lt;br /&gt;
|&lt;br /&gt;
The number matches part of the &#039;From:&#039; or &#039;To:&#039; entry in a SIP INVITE packet.&lt;br /&gt;
* only the part between &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;lt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; and &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;gt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; of the From/To line is tested.&lt;br /&gt;
* value &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; will match &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller1&amp;quot; &amp;lt;sip:234&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;, but also &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller2&amp;quot; &amp;lt;sip:12345@test&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;&lt;br /&gt;
* to match from the start, use &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;sip:234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Correlating SIP packets for the same Call-ID will match.&lt;br /&gt;
&lt;br /&gt;
The RTP packets correlated to this SIP call will also match.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
| virtual link group&lt;br /&gt;
| the virtual link group the packet belongs to&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Negate: Controls comparison of the rule condition to the value. If this is off, the value must match. &lt;br /&gt;
:If this is on, the value must not match.&lt;br /&gt;
* Action: What shall be done with the matching packets.&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Action !! Description&lt;br /&gt;
|-&lt;br /&gt;
| Snapshot length&lt;br /&gt;
| The packet is captured with a max length as specified in the input field below. If the packet is larger, the remaining bytes will be discarded.&lt;br /&gt;
|-&lt;br /&gt;
| Discard&lt;br /&gt;
| Discard the whole packet.&lt;br /&gt;
|-&lt;br /&gt;
| Full&lt;br /&gt;
| The whole packet is captured.&lt;br /&gt;
|-&lt;br /&gt;
| Header + data&lt;br /&gt;
|&lt;br /&gt;
Capture just certain parts of the packet.&lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 header&#039;&#039;&#039;, layer 2 and layer 3 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 header&#039;&#039;&#039;, layer 2, 3 and 4 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 + L7 data&#039;&#039;&#039;, an input field is shown where the length of layer 7 data can be configured.  In this case layer 2, 3 and 4 are stored together with the specified amount of layer 7 data.&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Analyzing the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is activated it is possible to restart the packet processing core and analyze all packets contained in the packet ring buffer. &lt;br /&gt;
When the Analyze packet ring buffer button is pressed a dialog will appear which allows to choose the time range of the packet ring buffer which is to be replayed. &lt;br /&gt;
After confirming this dialog the Network Multimeter will reset all statistics and start analyzing the contents of the packet ring buffer. &lt;br /&gt;
Progress, statistics and the option to resume normal operation will appear on the Packet ring buffer page.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== Extracting the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is active the complete contents of it can be extracted by capturing the complete timespan that is contained within. &lt;br /&gt;
For convenience a button labeled Extract packet ring buffer is available that opens the capture dialog with the start time and end time set to the appropriate values.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3048</id>
		<title>Packet ring buffer</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Packet_ring_buffer&amp;diff=3048"/>
		<updated>2020-10-09T10:02:09Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Packet ring buffer==&lt;br /&gt;
The ring buffer feature allows to create a buffer of fixed size on an external storage device to which all processed packets will be recorded. &lt;br /&gt;
If the fixed size buffer is full then the oldest packets in the buffer will be replaced with new packets in a round-robin fashion. &lt;br /&gt;
If the feature is not enabled a button titled &#039;&#039;&#039;Create ring buffer&#039;&#039;&#039; is visible. &lt;br /&gt;
Upon clicking on it a dialogue will be displayed and allows you to specify the size of the ring buffer. &lt;br /&gt;
It must be ensured that enough space is available on the external storage device. &lt;br /&gt;
As soon as the ring buffer has been created statistics about the ring buffer will be displayed instead of the button:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer1.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
* Timestamp of oldest packet: The timestamp of the oldest packet in the ring buffer.&lt;br /&gt;
&lt;br /&gt;
* Total size: The total size of the ring buffer on the external storage device. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication an adjusted value is displayed to reflect the redundant copies of packet data. &lt;br /&gt;
:The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
&lt;br /&gt;
* Used size: The currently used amount of memory in the capture buffer. &lt;br /&gt;
:If the cluster packet ring buffer feature is active and the Write redundancy level is set to a different value than no replication an adjusted value is displayed to reflect the redundant copies of packet data. The raw on-disk value will be displayed next to it in parentheses.&lt;br /&gt;
* Overall bytes captured since start: The amount of captured bytes since system start. &lt;br /&gt;
:This may be smaller than the used size if the system has been restarted. And it may be larger than the used size in case the ring buffer is full. &lt;br /&gt;
:The history graph shows the captured traffic of the last minute or in the selected interval (if set).&lt;br /&gt;
* Bytes dropped since start: The traffic which was processed but could not be written to the ring buffer since the start of processing. &lt;br /&gt;
:This is usually an indicator that writes to the external storage device were not fast enough.  The history graph shows the drops over time.&lt;br /&gt;
* Bytes discarded due to snapshot length rules since start: The traffic which matched the snapshot length rules criteria and was not written to the ring buffer. &lt;br /&gt;
:The history graph shows discarding over time.&lt;br /&gt;
* Data in flight: The amount of data which is currently stored in the queue that holds processed packets before they are written to the packet ring buffer. &lt;br /&gt;
:If larger bursts of traffic need to be stored in this queue the size can be modified in the capture module settings.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer2.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
When the ring buffer is full and old packets are deleted, the graphs will show the time range with no data in darkgrey background color. &lt;br /&gt;
The time range before start of the ring buffer will be visualized in the same way.&lt;br /&gt;
When the ring buffer is running, the behavior of the PCAP capture buttons throughout the system changes: if the user interface is in live mode and a capture is started, a dialog will appear asking to specify from how far back in time the capture should start. &lt;br /&gt;
This way it is possible to e.g. capture the traffic of an IP address starting from an hour ago. &lt;br /&gt;
The capture will also continue with live traffic. &lt;br /&gt;
If the user interface is in &#039;&#039;&#039;back-in-time&#039;&#039;&#039; mode (a timespan from the past is selected) starting a capture will produce a dialog asking to confirm that the capture will cover exactly the timespan selected. &lt;br /&gt;
The capture will automatically stop after the selected timespan has been processed. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Create Packet ring buffer3.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Cluster ring buffer ==== &lt;br /&gt;
The cluster ring buffer feature allows to use multiple whole disks in parallel for a single packet ring buffer. &lt;br /&gt;
It also allows to optionally write redundant copies of packets to multiple disks to provide fault tolerance in case of a disk failure.&lt;br /&gt;
&lt;br /&gt;
It is also possible to create multiple cluster packet ring buffers that&lt;br /&gt;
run in parallel. To enable multiple cluster packet ring buffers the&lt;br /&gt;
option `The maximum number of concurrent packet ring buffers` in the&lt;br /&gt;
capture module options can be set to the required number.&lt;br /&gt;
&lt;br /&gt;
When clicking the &#039;&#039;&#039;Create cluster ring buffer&#039;&#039;&#039; button an empty cluster ring buffer will be created and the &#039;&#039;&#039;Cluster configuration&#039;&#039;&#039; tab on the now visible packet ring buffer statistics page becomes available. &lt;br /&gt;
&lt;br /&gt;
If multiple cluster packet ring buffers are used the page will show&lt;br /&gt;
a number of buttons at the top to switch between the different clusters.&lt;br /&gt;
Each cluster has it&#039;s own statistics and configuration.&lt;br /&gt;
&lt;br /&gt;
In the Cluster configuration tab you can configure the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; at the very top. &lt;br /&gt;
This level controls how many redundant copies of each packet are written. &lt;br /&gt;
no replication means, that only a single copy of each packet is written and provides no redundancy. &lt;br /&gt;
This level gives the highest write bandwidth for a given number of disks. single replication means that one additional copy of each packet is written to some other disk and thus reduces the total write performance for a given number of disk to half the performance of no replication. &lt;br /&gt;
double replication and triple replication write two and three additional copies of each packet respectively. &lt;br /&gt;
Note that for each level to work there must be at least the number of replications + 1 disks available in the cluster.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster3.png|600px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
Below the &#039;&#039;&#039;Write redundancy level&#039;&#039;&#039; setting is the list of all disks available for use in the cluster. &lt;br /&gt;
Following columns are displayed in the list:&lt;br /&gt;
* Disk: A description of the disk and its capacity.&lt;br /&gt;
* Enclosure: If the disk is part of a multi-disk enclosure this column will show the enclosure number along with the slot number.&lt;br /&gt;
* Status: If the disk has been added to the cluster this column will display the current status as &#039;&#039;&#039;ok&#039;&#039;&#039; or &#039;&#039;&#039;failed&#039;&#039;&#039;. If multiple cluster packet ring buffers are used this will also show if the disk is active in another cluster.&lt;br /&gt;
* Locator: For disks in a multi-disk enclosure the button displayed in this column allows to turn the slot locator LED on and off. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
In the last unlabeled column there are three buttons displayed which have the following functionality:&lt;br /&gt;
* Add to cluster: Add a fresh disk to the cluster. &lt;br /&gt;
:The disk will be formatted and added as empty storage to the cluster. All previous data on the disk is lost.&lt;br /&gt;
* Resume in cluster: If the disk was previously part of a cluster it can be resumed. &lt;br /&gt;
:The data on that disk is now part of the packet ring buffer.&lt;br /&gt;
* Remove from cluster: Remove the disk from the ring buffer. &lt;br /&gt;
:The data stored on that disk is not part of the packet ring buffer anymore but the data is not removed from the disk. It can be resumed in the cluster at a later time.&lt;br /&gt;
&lt;br /&gt;
:If a disk is missing because it was e.g. removed from the enclosure it will be displayed in a separate list with much of the information as in the list described above but only one button with the option to remove it from the cluster packet ring buffer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
{|class=&amp;quot;wikitable sortable&amp;quot; &lt;br /&gt;
|-&lt;br /&gt;
|[[File:Cluster4.png|1200px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Packet ring buffer snapshot length filter ====&lt;br /&gt;
Rules can be configured that control the snapshot length of each packet which shall be stored in the packet ring buffer. &lt;br /&gt;
These rules can also be used to prevent certain packets from being stored in the packet ring buffer. &lt;br /&gt;
This allows to fine tune how much packet data needs to be written to the packet ring buffer. &lt;br /&gt;
The information about the original length of a packet will still be available in captures except when the packet was not written to the packet ring buffer at all (e.g. due to a &#039;&#039;&#039;discard&#039;&#039;&#039; rule). &lt;br /&gt;
&lt;br /&gt;
These rules can be created, edited, deleted, moved up and moved down in the rules list by using the respective buttons.&lt;br /&gt;
&lt;br /&gt;
Evaluation of the rules takes place in the order of the rules as displayed in the rules list from top to bottom. &lt;br /&gt;
The first rule that matches for a given packet will be applied and no further rules will be evaluated for that packet. &lt;br /&gt;
This means that the most generic rule should be at the bottom of the list (like e.g. ‘all packets will be discarded’) and more specific rules should be higher up in the list (like e.g ‘packets with an IP matching 192.168.1.0/24 will be fully captured’).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
When creating a snapshot length filter rule, a dialog is displayed and allows following options:&lt;br /&gt;
* Rule condition: Specify which packets to match.&lt;br /&gt;
&lt;br /&gt;
:The input field below allows entering the corresponding value.&lt;br /&gt;
&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Rule condition&lt;br /&gt;
! Description&lt;br /&gt;
|-&lt;br /&gt;
| All packets&lt;br /&gt;
| everything&lt;br /&gt;
|-&lt;br /&gt;
| MAC address&lt;br /&gt;
| source or destination MAC address&lt;br /&gt;
|-&lt;br /&gt;
| IP address&lt;br /&gt;
| source or destination IP address or subnet&lt;br /&gt;
|-&lt;br /&gt;
| TCP port&lt;br /&gt;
| the source or destination TCP port&lt;br /&gt;
|-&lt;br /&gt;
| UDP port&lt;br /&gt;
| the source or destination UDP port&lt;br /&gt;
|-&lt;br /&gt;
| Layer 7 protocol&lt;br /&gt;
| the selected layer 7 protocol&lt;br /&gt;
|-&lt;br /&gt;
| outer VLAN tag&lt;br /&gt;
| the most outer VLAN tag (directly after ethernet header) &lt;br /&gt;
|-&lt;br /&gt;
| interface&lt;br /&gt;
| the ingress interface the packet originated from&lt;br /&gt;
|-&lt;br /&gt;
| SIP phone number&lt;br /&gt;
|&lt;br /&gt;
The number matches part of the &#039;From:&#039; or &#039;To:&#039; entry in a SIP INVITE packet.&lt;br /&gt;
* only the part between &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;lt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; and &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;&amp;gt;&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; of the From/To line is tested.&lt;br /&gt;
* value &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039; will match &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller1&amp;quot; &amp;lt;sip:234&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;, but also &#039;&amp;lt;nowiki&amp;gt;From: &amp;quot;Caller2&amp;quot; &amp;lt;sip:12345@test&amp;gt;&amp;lt;/nowiki&amp;gt;&#039;&lt;br /&gt;
* to match from the start, use &#039;&#039;&#039;&amp;lt;nowiki&amp;gt;&#039;sip:234&#039;&amp;lt;/nowiki&amp;gt;&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Correlating SIP packets for the same Call-ID will match.&lt;br /&gt;
&lt;br /&gt;
The RTP packets correlated to this SIP call will also match.&lt;br /&gt;
&lt;br /&gt;
|-&lt;br /&gt;
| virtual link group&lt;br /&gt;
| the virtual link group the packet belongs to&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
* Negate: Controls comparison of the rule condition to the value. If this is off, the value must match. &lt;br /&gt;
:If this is on, the value must not match.&lt;br /&gt;
* Action: What shall be done with the matching packets.&lt;br /&gt;
:{| class=&amp;quot;wikitable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
! Action !! Description&lt;br /&gt;
|-&lt;br /&gt;
| Snapshot length&lt;br /&gt;
| The packet is captured with a max length as specified in the input field below. If the packet is larger, the remaining bytes will be discarded.&lt;br /&gt;
|-&lt;br /&gt;
| Discard&lt;br /&gt;
| Discard the whole packet.&lt;br /&gt;
|-&lt;br /&gt;
| Full&lt;br /&gt;
| The whole packet is captured.&lt;br /&gt;
|-&lt;br /&gt;
| Header + data&lt;br /&gt;
|&lt;br /&gt;
Capture just certain parts of the packet.&lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 header&#039;&#039;&#039;, layer 2 and layer 3 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 header&#039;&#039;&#039;, layer 2, 3 and 4 headers are stored. &lt;br /&gt;
&lt;br /&gt;
When selecting &#039;&#039;&#039;L3 + L4 + L7 data&#039;&#039;&#039;, an input field is shown where the length of layer 7 data can be configured.  In this case layer 2, 3 and 4 are stored together with the specified amount of layer 7 data.&lt;br /&gt;
&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==== Analyzing the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is activated it is possible to restart the packet processing core and analyze all packets contained in the packet ring buffer. &lt;br /&gt;
When the Analyze packet ring buffer button is pressed a dialog will appear which allows to choose the time range of the packet ring buffer which is to be replayed. &lt;br /&gt;
After confirming this dialog the Network Multimeter will reset all statistics and start analyzing the contents of the packet ring buffer. &lt;br /&gt;
Progress, statistics and the option to resume normal operation will appear on the Packet ring buffer page.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==== Extracting the packet ring buffer ====&lt;br /&gt;
When the packet ring buffer is active the complete contents of it can be extracted by capturing the complete timespan that is contained within. &lt;br /&gt;
For convenience a button labeled Extract packet ring buffer is available that opens the capture dialog with the start time and end time set to the appropriate values.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=USB_Presenter_Capture&amp;diff=3020</id>
		<title>USB Presenter Capture</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=USB_Presenter_Capture&amp;diff=3020"/>
		<updated>2020-09-17T11:16:38Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;accesscontrol&amp;gt;AC:GroupUsers&amp;lt;/accesscontrol&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This page describes how the Allegro Network Multimeter allows a user to start a capture with a USB presenter. This capture can be actioned &#039;Back in Time&#039; for a defined period. In addition, the capture files can be uploaded to an SFTP server at a defined time.&lt;br /&gt;
&lt;br /&gt;
This feature has been designed to allow non-IT staff to record pcaps when an error occurs; it also allows for captures without opening a Web interface.&lt;br /&gt;
&lt;br /&gt;
== Requirements ==&lt;br /&gt;
&lt;br /&gt;
This feature is supported by all Allegro Network Multimeters, even for the VM Version starting at firmware Release 3.0. It requires a free USB port on the Allegro with USB 2.0 or higher. One internal or external disk needs to be configured at &#039;&#039;&#039;Generic&#039;&#039;&#039; → &#039;&#039;&#039;Storage&#039;&#039;&#039; and a [[Packet ring buffer|ring buffer]] must be configured. Please note that the capture is extracted from the ring buffer and a ring buffer filter rules for packet slicing will affect the exported pcap.&lt;br /&gt;
&lt;br /&gt;
As of now, the Logitech R400 is supported. Allegro will add more presenters on request. An optional USB sound device will play a beep when a key has been pressed.&lt;br /&gt;
&lt;br /&gt;
== USB Capture Trigger Setup ==&lt;br /&gt;
&lt;br /&gt;
Connect the Logitech R400 USB dongle with the Allegro. If you have a Virtual Edition Allegro, please pass-through the USB device directly to the Allegro VM.&lt;br /&gt;
&lt;br /&gt;
Once this is done, navigate to the &#039;&#039;&#039;Settings&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;Expert settings&#039;&#039;&#039; page and open the &#039;&#039;&#039;USB capture trigger&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
[[File:Presenter dialog.png|600px]]&lt;br /&gt;
&lt;br /&gt;
Once any key has been pressed on the presenter, one pcap will be generated. The pcap end time is when the button has been pressed and the start time is defined by the capture interval. As example, an interval of 60 seconds will generate a capture of the last minute when a presenter key was pressed.&lt;br /&gt;
&lt;br /&gt;
The captures are stored at the root directory of the storage device or, if enabled, in the upload directory for SFTP uploads.&lt;br /&gt;
&lt;br /&gt;
== SFTP Export Setup ==&lt;br /&gt;
&lt;br /&gt;
The Allegro can automatically upload pcap files to an SFTP server from the upload directory on the disk. To configure it, please navigate to &#039;&#039;&#039;Settings&#039;&#039;&#039; → &#039;&#039;&#039;Remote Access and Export&#039;&#039;&#039; → &#039;&#039;&#039;Pcap export via SFTP&#039;&#039;&#039;. This allow to export all captured pcap files at a certain time of day. As example it can be used to transfer pcaps during the night from remote locations to a central SFTP server.&lt;br /&gt;
&lt;br /&gt;
[[File:Sftp export.png|1000px]]&lt;br /&gt;
&lt;br /&gt;
== Advanced Multi-pcap Setup ==&lt;br /&gt;
&lt;br /&gt;
There are situations where the Allegro shall record multiple separate pcaps for a key with specific filters. This can be done by enabling the &#039;&#039;&#039;USB capture filter&#039;&#039;&#039; in the &#039;&#039;&#039;USB capture trigger&#039;&#039;&#039; dialog. The filter syntax is described in the [[Capture module]].&lt;br /&gt;
&lt;br /&gt;
A good example is the installation of an Allegro 500 with 2 links and 2 virtual link groups ( see [[Virtual Link Group Configuration Guide]]), one before and one behind the firewall.&lt;br /&gt;
&lt;br /&gt;
[[File:Presenter filter group.png|600px]]&lt;br /&gt;
&lt;br /&gt;
As a second example you can record pcaps of up to 4 different IP addresses at the same time with just one click.&lt;br /&gt;
&lt;br /&gt;
[[File:Presenter filter ip.png|600px]]&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=USB_Presenter_Capture&amp;diff=3019</id>
		<title>USB Presenter Capture</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=USB_Presenter_Capture&amp;diff=3019"/>
		<updated>2020-09-17T11:14:18Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;accesscontrol&amp;gt;AC:GroupUsers&amp;lt;/accesscontrol&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This page describes how the Allegro Network Multimeter allows a user to start a capture with a USB presenter. This capture can be actioned &#039;Back in Time&#039; for a defined period. In addition, the capture files can be uploaded to an SFTP server at a defined time.&lt;br /&gt;
&lt;br /&gt;
This feature has been designed to allow non-IT staff to record pcaps when an error occurs; it also allows for captures without opening a Web interface.&lt;br /&gt;
&lt;br /&gt;
== Requirements ==&lt;br /&gt;
&lt;br /&gt;
This feature is supported by all Allegro Network Multimeters, even for the VM Version starting at firmware Release 3.0. It requires a free USB port on the Allegro with USB 2.0 or higher. One internal or external disk needs to be configured at &#039;&#039;&#039;Generic&#039;&#039;&#039; → &#039;&#039;&#039;Storage&#039;&#039;&#039; and a [[Packet ring buffer|ring buffer]] must be configured. Please note that the capture is extracted from the ring buffer and a ring buffer filter rules for packet slicing will affect the exported pcap.&lt;br /&gt;
&lt;br /&gt;
As of now, the Logitech R400 is supported. Allegro will add more presenters on request. An optional USB sound device will play a beep when a key has been pressed.&lt;br /&gt;
&lt;br /&gt;
== USB Capture Trigger Setup ==&lt;br /&gt;
&lt;br /&gt;
Please connect the Logitech R400 USB dongle with the Allegro. If you have a Virtual Edition Allegro, please pass-through the USB device directly to the Allegro VM.&lt;br /&gt;
&lt;br /&gt;
Once this is done, navigate to the &#039;&#039;&#039;Settings&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;Expert Settings&#039;&#039;&#039; page and open the &#039;&#039;&#039;USB capture trigger&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
[[File:Presenter dialog.png|600px]]&lt;br /&gt;
&lt;br /&gt;
Once any key has been pressed on the presenter, one pcap will be generated. The pcap end time is when the button has been pressed and the start time is defined by the capture interval. As example, an interval of 60 seconds will generate a capture of the last minute when a presenter key was pressed.&lt;br /&gt;
&lt;br /&gt;
The captures are stored at the root directory of the storage device or, if enabled, in the upload directory for SFTP uploads.&lt;br /&gt;
&lt;br /&gt;
== SFTP Export Setup ==&lt;br /&gt;
&lt;br /&gt;
The Allegro can automatically upload pcap files to an SFTP server from the upload directory on the disk. To configure it, please navigate to &#039;&#039;&#039;Settings&#039;&#039;&#039; → &#039;&#039;&#039;Remote Access and Export&#039;&#039;&#039; → &#039;&#039;&#039;Pcap export via SFTP&#039;&#039;&#039;. This allow to export all captured pcap files at a certain time of day. As example it can be used to transfer pcaps during the night from remote locations to a central SFTP server.&lt;br /&gt;
&lt;br /&gt;
[[File:Sftp export.png|1000px]]&lt;br /&gt;
&lt;br /&gt;
== Advanced Multi-pcap Setup ==&lt;br /&gt;
&lt;br /&gt;
There are situations where the Allegro shall record multiple separate pcaps for a key with specific filters. This can be done by enabling the &#039;&#039;&#039;USB capture filter&#039;&#039;&#039; in the &#039;&#039;&#039;USB capture trigger&#039;&#039;&#039; dialog. The filter syntax is described in the [[Capture module]].&lt;br /&gt;
&lt;br /&gt;
A good example is the installation of an Allegro 500 with 2 links and 2 virtual link groups ( see [[Virtual Link Group Configuration Guide]]), one before and one behind the firewall.&lt;br /&gt;
&lt;br /&gt;
[[File:Presenter filter group.png|600px]]&lt;br /&gt;
&lt;br /&gt;
As a second example you can record pcaps of up to 4 different IP addresses at the same time with just one click.&lt;br /&gt;
&lt;br /&gt;
[[File:Presenter filter ip.png|600px]]&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=USB_Presenter_Capture&amp;diff=3018</id>
		<title>USB Presenter Capture</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=USB_Presenter_Capture&amp;diff=3018"/>
		<updated>2020-09-17T11:11:08Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&amp;lt;accesscontrol&amp;gt;AC:GroupUsers&amp;lt;/accesscontrol&amp;gt;&lt;br /&gt;
&lt;br /&gt;
This page describes how the Allegro Network Multimeter allows a user to start a capture with a USB presenter. This capture can be actioned &#039;Back in Time&#039; for a defined period. In addition, the capture files can be uploaded to an SFTP server at a defined time.&lt;br /&gt;
&lt;br /&gt;
This feature has been designed to allow non-IT staff to record pcaps when an error occurs; it also allows for captures without opening a web interface.&lt;br /&gt;
&lt;br /&gt;
== Requirements ==&lt;br /&gt;
&lt;br /&gt;
This feature is supported by all Allegro Network Multimeters, even for the VM Version starting at firmware version 3.0. It requires a free USB port on the Allegro with USB 2.0 or higher. One internal or external disk needs to be configured at &#039;&#039;&#039;Generic&#039;&#039;&#039; → &#039;&#039;&#039;Storage&#039;&#039;&#039; and a [[Packet ring buffer|ring buffer]] must be configured. Please note that the capture is extracted from the ring buffer and a ring buffer filter rules for packet slicing will affect the exported pcap.&lt;br /&gt;
&lt;br /&gt;
As of now, the Logitech R400 is supported. Allegro will add more presenter on request. An optional USB sound device will play a beep when a key has been pressed.&lt;br /&gt;
&lt;br /&gt;
== USB Capture Trigger Setup ==&lt;br /&gt;
&lt;br /&gt;
Please connect the Logitech R400 USB dongle with the Allegro. If you have a virtual Allegro, please pass-through the USB device directly to the Allegro VM.&lt;br /&gt;
&lt;br /&gt;
Once this is done, navigate to the &#039;&#039;&#039;Settings&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;Expert Settings&#039;&#039;&#039; page and open the &#039;&#039;&#039;USB capture trigger&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
[[File:Presenter dialog.png|600px]]&lt;br /&gt;
&lt;br /&gt;
Once any key has been pressed on the presenter, one pcap will be generated. The pcap end time is when the button has been pressed and the start time is defined by the capture interval. As example, an interval of 60 seconds will generate a capture of the last minute when a presenter key has been pressed.&lt;br /&gt;
&lt;br /&gt;
The captures are stored at the root directory of the storage device or, if enabled, in the upload directory for sftp uploads.&lt;br /&gt;
&lt;br /&gt;
== SFTP Export Setup ==&lt;br /&gt;
&lt;br /&gt;
The Allegro can automatically upload pcap files to an SFTP server from the upload directory on the disk. To configure it, please navigate to &#039;&#039;&#039;Settings&#039;&#039;&#039; → &#039;&#039;&#039;Remote Access and Export&#039;&#039;&#039; → &#039;&#039;&#039;Pcap export via SFTP&#039;&#039;&#039;. This allow to export all captured pcap files at a certain time of day. As example it can be used to transfer pcaps during the night from remote locations to a central sftp server.&lt;br /&gt;
&lt;br /&gt;
[[File:Sftp export.png|1000px]]&lt;br /&gt;
&lt;br /&gt;
== Advanced Multi-Pcap Setup ==&lt;br /&gt;
&lt;br /&gt;
There are situations where the Allegro shall record multiple separate pcaps for a key with specific filters. This can be done by enabling the &#039;&#039;&#039;USB capture filter&#039;&#039;&#039; in the &#039;&#039;&#039;USB capture trigger&#039;&#039;&#039; dialog. The filter syntax is described in the [[Capture module]].&lt;br /&gt;
&lt;br /&gt;
A good example is the installation of an Allegro 500 with 2 links and 2 virtual link groups ( see [[Virtual Link Group Configuration Guide]]), one before and one behind the firewall.&lt;br /&gt;
&lt;br /&gt;
[[File:Presenter filter group.png|600px]]&lt;br /&gt;
&lt;br /&gt;
As a second example you can record Pcaps of up to 4 different IP addresses at the same time with just one click.&lt;br /&gt;
&lt;br /&gt;
[[File:Presenter filter ip.png|600px]]&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Global_settings&amp;diff=2846</id>
		<title>Global settings</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Global_settings&amp;diff=2846"/>
		<updated>2020-05-22T15:29:12Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* Expert settings */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;The Global settings section contains parameters for adjusting the behavior of the system.&lt;br /&gt;
The settings are split among multiple tabs, described as follows.&lt;br /&gt;
&lt;br /&gt;
== Generic settings ==&lt;br /&gt;
&lt;br /&gt;
=== Packet processing mode ===&lt;br /&gt;
&lt;br /&gt;
This section allows for configuring the main packet processing mode:&lt;br /&gt;
&lt;br /&gt;
* Bridge mode: In Bridge mode, all received packets will be retransmitted on the corresponding mutual port so that the device can be placed inline between any network component. The device will be transparent and will not modify the traffic in any way. The additional latency will be typically around or less than 1 millisecond.&lt;br /&gt;
* Sink mode: In Sink mode, packets are only received and not forwarded. This operation mode allows for installation at a Mirror port of a Switch or when using a network Tap to access the network traffic.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The packet processing mode can be changed during runtime.&lt;br /&gt;
&lt;br /&gt;
=== Webshark support ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter allows having a preview of the first Megabyte of packets directly in the browser, called Webshark. To support this, the device needs a small amount of system memory for packet processing. This amount of memory (~100MB) will be reserved by the Multimeter and is not available for the In-Memory database used to store metadata, thus the history of stored metadata is a little shorter. If this is not desired, it is possible to disable the Webshark support. Changing this value requires a restart of the processing.&lt;br /&gt;
&lt;br /&gt;
=== Limit module processing ===&lt;br /&gt;
&lt;br /&gt;
This setting allows you to configure which modules are active. With this setting, the performance of the Allegro Network Multimeter can be significantly improved and allows a higher throughput if you do not need to select some analysis modules.&lt;br /&gt;
&lt;br /&gt;
The following modes are possible:&lt;br /&gt;
&lt;br /&gt;
* Only capturing: Only interface statistics and the capture module is provided. The capture filters are supported except Layer 7 protocol recognition.&lt;br /&gt;
* Up to Layer 2: Additionally all Layer 2 related modules are active such as MAC, MAC protocols, ARP and Burst Analysis.&lt;br /&gt;
* Up to Layer 3: Additionally all Layer 3 related modules are active such as IP and DHCP statistics.&lt;br /&gt;
* Up to Layer 4: Additionally all Layer 4 related modules are active such as TCP and Layer 4 server ports.&lt;br /&gt;
* Unlimited: All modules are active.&lt;br /&gt;
&lt;br /&gt;
When switching to another mode you need to restart the processing in order to activate the new settings.&lt;br /&gt;
&lt;br /&gt;
=== Graph detail settings ===&lt;br /&gt;
&lt;br /&gt;
It is possible to modify the detail level of all graphs in the interface. This settings allow you to see a more detailed view (with higher time resolution) or to reduce the detail level so more data can be stored on the device. Changing the default values has an impact on the performance and memory usage. Changing a slider to the left increases the detail level of graphs, but increases memory usage and decreases performance.&lt;br /&gt;
&lt;br /&gt;
* Best graph resolution: This option configures how detailed the graph information are shown in the best case (the latest information). The default value is one second which means that a graph sample point represents a second of packet time. You can change the resolution up to 1 millisecond which gives a detailed sub-second representation of the traffic. You can also decide to decrease the resolution which enables the Multimeter to store more data for a longer period of time.&lt;br /&gt;
&lt;br /&gt;
* Reduce graph resolution of old data by up to: The resolution of older graph data is automatically reduced to save memory and to allow a longer view into the traffic history. This option allows you to change this behaviour. With a reduction factor of 1/1 no reduction is done at all which means the selected graph resolution is available for the complete time. &lt;br /&gt;
:This reduces the time period to see historical data. You can choose to increase the reduction factor to store more data for a longer period. The time printed in parentheses represents the worst-case graph resolution based on the chosen resolution and reduction factor.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Note: Regardless of these settings, the graph values are always converted to represent a value per second (when applicable). For example, the packets per second for IP addresses will always be a value literally per second even if the resolution is larger or smaller than one second. The displayed value is scaled to match this view. Especially with sub-second resolution this might be misleading. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
For instance, if there is a network element sending one packet per second and the resolution is set to 100 milliseconds, the value might be shown as 10 packets per second as each sample point is scaled to represent an value per second. For a detailed investigation it is recommended to select a specific time interval since the total packet counters shown in all statistics are unscaled and represent the actual values.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Performance implications: The performance degradation and memory usage depends on the actual network traffic and is not exactly predictable. &lt;br /&gt;
&lt;br /&gt;
Here are some examples for reference on a Multimeter 1000 series with different configuration values (under ideal test conditions):&lt;br /&gt;
&lt;br /&gt;
* 1 second resolution, 1/1 reduction factor: 90% of default performance&lt;br /&gt;
* 100 millisecond resolution, 1/1 reduction factor: 50% of default performance,&lt;br /&gt;
* 10 millisecond resolution, 1/1 reduction factor: 15% of default performance&lt;br /&gt;
* 1 millisecond resolution, 1/1 reduction factor: 10% of default performance&lt;br /&gt;
&lt;br /&gt;
=== pcap parallel analysis ===&lt;br /&gt;
&lt;br /&gt;
The pcap parallel analysis feature allows to analyse pcap files or the&lt;br /&gt;
packet ring buffer in parallel to the live measurement. The settings&lt;br /&gt;
allow to enable the feature and choose how much memory of the main&lt;br /&gt;
memory is used for parallel analysis and how many parallel slots can&lt;br /&gt;
be used. Detailed description of the configuration values are&lt;br /&gt;
described [[pcap parallel analysis|here]].&lt;br /&gt;
&lt;br /&gt;
== IPFIX settings ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter may be running as an IPFIX exporter. These settings allows for reporting configuration. When enabled, the following settings are possible:&lt;br /&gt;
&lt;br /&gt;
* IP address: Address of IPFIX collector.&lt;br /&gt;
* Port: Corresponding port.&lt;br /&gt;
* Protocol: TCP or UDP.&lt;br /&gt;
* Update interval: Interval in seconds for sending a status update of flows.&lt;br /&gt;
* UDP resend interval: Interval in seconds for resending IPFIX templates for UDP connections.&lt;br /&gt;
* TCP reconnect timeout: When TCP connections could not be established, wait for this time period until the next attempt to establish a connection.&lt;br /&gt;
&lt;br /&gt;
Individual IPFIX messages can be enabled or disabled by toggling corresponding options. See the NetFlow/IPFIX interface documentation for details about the message types.&lt;br /&gt;
&lt;br /&gt;
== Time settings ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can be configured to use a time synchronization service. NTP is supported for all variants of the Multimeter. PTP service may be used if management interface supports hardware time stamping.&lt;br /&gt;
If a GPS-capable PTP grandmaster card is available, GPS time synchronization is available and the antenna cable delay in nanoseconds can be configured.&lt;br /&gt;
&lt;br /&gt;
To enable a time service, switch to the proper type in the dropdown box.&lt;br /&gt;
The time service field will show whether the selected service is running or not.&lt;br /&gt;
For NTP time retrieval you can specify and edit dedicated NTP servers. If you do not specify a NTP server, a set of predefined NTP servers will be automatically selected.&lt;br /&gt;
For PTP time retrieval, the PTP grandmaster clock identity is shown. This is usually an EUI-64 address. The first and last set of octets of the identity represent the (EUI-48) MAC address of the grandmaster.&lt;br /&gt;
&lt;br /&gt;
The following settings are possible for PTP and should match the settings of the PTP grandmaster:&lt;br /&gt;
&lt;br /&gt;
* Delay mechanism: Use end-to-end (E2E), peer-to-peer (P2P) or automatic delay measurement. In case automatic measurement is selected, E2E is used at the beginning and switched to P2P when a peer delay request is received. Default is &#039;&#039;&#039;Auto&#039;&#039;&#039;.&lt;br /&gt;
* Network transport: Use UDPv4, UDPv6 or Layer 2 as network transport. Default is &#039;&#039;&#039;UDPv4&#039;&#039;&#039;.&lt;br /&gt;
* Domain number: The domain number of the grandmaster. This is used to define logical groups of synchronized clocks.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The GPS time retrieval option is available if a GPS capable PTP grandmaster card is installed in the Multimeter. &lt;br /&gt;
If no time synchronization mechanism is selected the date and time of the device can be manually configured by entering a properly formatted date and time description.&lt;br /&gt;
Below the time synchronization settings, the time zone used by the device can be configured. The drop-down list provides a list of cities grouped by world regions to select the appropriate time zone.&lt;br /&gt;
To make changes take effect, click on the Save settings button at the bottom of the page. To reload the stored settings, click on Reload settings.&lt;br /&gt;
&lt;br /&gt;
== Email notification ==&lt;br /&gt;
&lt;br /&gt;
Certain modules support the sending of email notifications. The following settings are used to globally configure the SMTP server used  and the target email address that will receive the notifications:&lt;br /&gt;
&lt;br /&gt;
* Enable email notifications: globally enables or disables the sending of email notifications.&lt;br /&gt;
* SMTP server address: the address of the SMTP server that will be used to send notification emails.&lt;br /&gt;
* SMTP server port: the TCP port on which the SMTP server is listening.&lt;br /&gt;
* SMTP server uses SSL: must be set to On if the SMTP server expects an SSL connection from the very start. If the SMTP server uses no SSL or STARTTLS this setting must be set to Off.&lt;br /&gt;
* Ignore certificate errors: if the SSL certificate should not be validated because e.g. it is a self-signed certificate this setting can be used to turn off certificate validation.&lt;br /&gt;
* Allow unencrypted connections: if an unencrypted connection must be allowed because e.g. a legacy SMTP server does not support it this setting can be used.&lt;br /&gt;
* Username: the username used to log in to the SMTP server.&lt;br /&gt;
* Password: the password used to log in to the SMTP server.&lt;br /&gt;
* From email address: the email address from which incident notifications will be sent.&lt;br /&gt;
* Target email address: the email address to which incident notifications will be sent.&lt;br /&gt;
* Email links base URL: this base URL will be used to generate the HTML links in notification emails. Since the device cannot by itself determine the proper address by which it is visible to the email recipient this setting can be used to set the correct URL prefix for links sent with the notification emails.&lt;br /&gt;
* Send periodic system status mail: if set to hourly or daily, a system status email will be sent to the configured target address with the selected frequency. It will contain basic system information and system health status, management interface configuration and a list of detected LLDP neighbours if the management LLDP feature is enabled.&lt;br /&gt;
&lt;br /&gt;
The Send test email button can be used to verify that the entered settings are working.&lt;br /&gt;
&lt;br /&gt;
== Expert settings ==&lt;br /&gt;
&lt;br /&gt;
The Expert settings contains parameter which are only necessary to change in rare installation scenarios or some specific need for a different operation mode.&lt;br /&gt;
&lt;br /&gt;
=== Packet length accounting ===&lt;br /&gt;
&lt;br /&gt;
This setting allows you to configure which packet length is used for all traffic counters and incidents. The following modes are possible:&lt;br /&gt;
&lt;br /&gt;
* Layer 1: Packet length is accounted on Layer 1 including preamble (7 Byte), SFD (1 Byte) and inter-frame gap (12 Bytes)&lt;br /&gt;
* Layer 2 without frame check sequence (default): Packet length is accounted on Layer 2 without a frame check sequence (4 Bytes)&lt;br /&gt;
* Layer 2 with frame check sequence: Account packet length on Layer 2 with frame check sequence (4 Bytes) When switching to another mode, it will only be applied on new packets. Older packet size statistics will not be changed.&lt;br /&gt;
&lt;br /&gt;
=== VLAN handling ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can ignore VLAN tags for connection tracking. Enabling this option may be necessary if network traffic is seen on the Network Multimeter that contains changing VLAN tags for the same connection. For example, depending on the configuration of the Mirror Port to which the Network Multimeter is connected, incoming traffic could contain a VLAN tag while outgoing traffic does not. In this example, a connection would appear twice in the statistics which is often the desired behaviour to be able to identify a network misconfiguration. But sometimes this behaviour is intended and the user wants to see only one connection. In this scenario the option can be enabled to ignore varying VLAN tags for a otherwise identical connection.&lt;br /&gt;
&lt;br /&gt;
=== Tunnel view mode ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can decapsulate ERSPAN type II and type III traffic. In this mode all non-ERSPAN traffic is discarded. On the Dashboard a dropped counter will display dropped non ERSPAN packets for indication if this mode is active. The Multimeter will show the encapsulated content in all analysis modules. When capturing, packets with complete outer Layer 2, Layer 3, GRE and ERSPAN headers will be stored as seen on the wire.&lt;br /&gt;
&lt;br /&gt;
=== Database mode settings ===&lt;br /&gt;
&lt;br /&gt;
The database mode is a special analysis mode for high-performance Network Multimeters with multiple processors to increase the performance on such systems. It is normally enabled automatically but depending on the actual network traffic and system usage, some parameter tweak might be necessary to improve overall system performance. &lt;br /&gt;
You should only change these parameters in discussion with the Allegro Packets support department.&lt;br /&gt;
These settings are only visible if your Network Multimeter is capable of running this mode.&lt;br /&gt;
&lt;br /&gt;
You can read more about the meaning of the settings [[DB mode|here]].&lt;br /&gt;
&lt;br /&gt;
=== Network performance ===&lt;br /&gt;
&lt;br /&gt;
There are several network performance settings available to improve performance on high-performance systems in case of packet drops during very high incoming bandwidth. They are only visible if your Network Multimeter is capable of changing these settings.&lt;br /&gt;
&lt;br /&gt;
* Max RX queues per socket: This setting specifies the quantity of threads dedicated to read and write interactions with the network interface controllers. By increasing this value, network receive bandwidth can be increased before packet drops occur. By decreasing this value, data analysis will improve. The default setting of 2 RX queues is suitable for most configurations since data analysis typically needs much more processing ressources.&lt;br /&gt;
* Use Hyper-Threading for RX queues: This setting allows enabling or disabling Hyper-Threading for the threads dedicated to read and write interactions with the network interface controllers. By disabling it, network performance can be improved as the RX queues will be distributed to physical CPU cores only. By enabling it, RX queues will also be distributed to virtual Hyper-Threading CPU cores which is not as efficient as physical CPU cores. By using Hyper-Threading, data analysis will improve since there are more CPU cores available for these tasks. Hyper-Threading is used by default. This is suitable for most configurations as data analysis typically needs much more processing ressources.&lt;br /&gt;
* Preferred Network interface controller: This setting allows fine tuning of network and data analysis performance for dedicated network controllers. The selected set of network controllers will be preferred over others. Usually the fastest or the network controller with the most traffic should be preferred. The &#039;&#039;&#039;Auto&#039;&#039;&#039; setting is used by default, preferring the fastest network controller.&lt;br /&gt;
&lt;br /&gt;
You should only change these parameters in discussion with the Allegro Packets support department.&lt;br /&gt;
&lt;br /&gt;
=== Processing performance ===&lt;br /&gt;
&lt;br /&gt;
Processing performance may be modified on high-performance systems. This is only visible if your Network Multimeter is capable of changing this setting.&lt;br /&gt;
&lt;br /&gt;
* Processing performance mode: This setting allows for fine tuning processing performance. By using &#039;&#039;&#039;Analysing&#039;&#039;&#039;, as much processing ressources on all CPUs as possible are used for data analysis. By using &#039;&#039;&#039;Capturing&#039;&#039;&#039;, the focus will be on high data throughput and low latency for capturing purposes by using only the CPU where the preferred newtork controller is attached to. This has an impact on data analysis performance. &#039;&#039;&#039;Analysing&#039;&#039;&#039; is used by default.&lt;br /&gt;
You should only change this parameter in discussion with the Allegro Packets support department.&lt;br /&gt;
&lt;br /&gt;
=== Packet ring buffer timeouts ===&lt;br /&gt;
&lt;br /&gt;
Two timeout settings related to the packet ring buffer can be adjusted.&lt;br /&gt;
&lt;br /&gt;
* The long timeout controls after which maximum period of time a packet is actually written to the packet ring buffer. A lower value may decrease the time difference by which packets are stored out of their order in the packet ring buffer but it may increase the amount of unused overhead data in the packet ring buffer.&lt;br /&gt;
* The short timeout controls after which period of time smaller batches of packets are written to the packet ring buffer even if waiting for more packets would result in a more efficient operation. A lower value may decrease the time difference by which packets are stored out of their order in the packet ring buffer but it may also decrease the performance of the packet ring buffer.&lt;br /&gt;
&lt;br /&gt;
=== Data retention timeout ===&lt;br /&gt;
&lt;br /&gt;
When this timeout is set to a value greater than 0, data will be removed from the system after a given number of minutes. This means that entities like IPs, which have been inactive for longer than the timeout, will be removed. History graph data for entities that are still active will be truncated to cover only the given timespan while the absolute values for the whole runtime will be retained. When a packet ring buffer is active, packets which are older than the timeout will be discarded.&lt;br /&gt;
&lt;br /&gt;
=== L3 tunnel mode ===&lt;br /&gt;
&lt;br /&gt;
If L3 tunnel mode is enabled for an interface, this interface will only process packets encapsulated in GRE or GRE+ERSPAN and targeted for the configured IP address. All other packets received on that interface will be discarded. The system will process the packets as if only the inner encapsulated packet is seen and any traffic captures will only contain the encapsulated packet. An interface with L3 tunnel mode enabled will respond to ARP requests and to ICMP echo requests so it is possible to use ping to verify that the interface is reachable under the configured IP address. Currently only IPv4 L3 tunnels are supported. It must be noted that if the system is running in bridge packet processing mode any links with an interface configured for L3 tunnel mode will not forward traffic.&lt;br /&gt;
&lt;br /&gt;
=== Multithreaded capture analysis ===&lt;br /&gt;
&lt;br /&gt;
This option enables the use of multiple CPUs for capture analysis like when&lt;br /&gt;
analyzing a pcap capture file or analyzing the packet ring buffer. Depending&lt;br /&gt;
on the number of available CPUs this can significantly speed up the analysis.&lt;br /&gt;
&lt;br /&gt;
It is possible to dedicate a number a CPUs exclusively to capture analysis.&lt;br /&gt;
Since these CPUs are not available for live packet processing the performance of&lt;br /&gt;
live traffic analysis may be lower.&lt;br /&gt;
When set to 0 a lower priority is used for capture analysis than for live analysis&lt;br /&gt;
but it cannot be ruled out that the performance of the live processing is&lt;br /&gt;
affected.&lt;br /&gt;
&lt;br /&gt;
=== Load balancing ===&lt;br /&gt;
&lt;br /&gt;
This option select the load distribution method. By default, network&lt;br /&gt;
traffic is balanced among all processing threads based on the IP&lt;br /&gt;
addresses. This is fast and usually the best way for efficient load&lt;br /&gt;
balancing.&lt;br /&gt;
&lt;br /&gt;
If the network traffic only occurs between a few IP addresses, this&lt;br /&gt;
method can lead to a load imbalance so that some threads are doing more&lt;br /&gt;
work while other threads may be idle. In this scenario, &amp;quot;flow based&lt;br /&gt;
balancing&amp;quot; can be enabled to distribute the traffic based on the IP&lt;br /&gt;
and port information. This will lead to better utilization of all&lt;br /&gt;
processing threads.&lt;br /&gt;
&lt;br /&gt;
Since this option induces additional processing overhead per packet&lt;br /&gt;
and additional memory for all internal IP statistics, it should only&lt;br /&gt;
be enabled in cases of significant load imbalance.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Global_settings&amp;diff=2845</id>
		<title>Global settings</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Global_settings&amp;diff=2845"/>
		<updated>2020-05-22T15:17:16Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* Email notification */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;The Global settings section contains parameters for adjusting the behavior of the system.&lt;br /&gt;
The settings are split among multiple tabs, described as follows.&lt;br /&gt;
&lt;br /&gt;
== Generic settings ==&lt;br /&gt;
&lt;br /&gt;
=== Packet processing mode ===&lt;br /&gt;
&lt;br /&gt;
This section allows for configuring the main packet processing mode:&lt;br /&gt;
&lt;br /&gt;
* Bridge mode: In Bridge mode, all received packets will be retransmitted on the corresponding mutual port so that the device can be placed inline between any network component. The device will be transparent and will not modify the traffic in any way. The additional latency will be typically around or less than 1 millisecond.&lt;br /&gt;
* Sink mode: In Sink mode, packets are only received and not forwarded. This operation mode allows for installation at a Mirror port of a Switch or when using a network Tap to access the network traffic.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The packet processing mode can be changed during runtime.&lt;br /&gt;
&lt;br /&gt;
=== Webshark support ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter allows having a preview of the first Megabyte of packets directly in the browser, called Webshark. To support this, the device needs a small amount of system memory for packet processing. This amount of memory (~100MB) will be reserved by the Multimeter and is not available for the In-Memory database used to store metadata, thus the history of stored metadata is a little shorter. If this is not desired, it is possible to disable the Webshark support. Changing this value requires a restart of the processing.&lt;br /&gt;
&lt;br /&gt;
=== Limit module processing ===&lt;br /&gt;
&lt;br /&gt;
This setting allows you to configure which modules are active. With this setting, the performance of the Allegro Network Multimeter can be significantly improved and allows a higher throughput if you do not need to select some analysis modules.&lt;br /&gt;
&lt;br /&gt;
The following modes are possible:&lt;br /&gt;
&lt;br /&gt;
* Only capturing: Only interface statistics and the capture module is provided. The capture filters are supported except Layer 7 protocol recognition.&lt;br /&gt;
* Up to Layer 2: Additionally all Layer 2 related modules are active such as MAC, MAC protocols, ARP and Burst Analysis.&lt;br /&gt;
* Up to Layer 3: Additionally all Layer 3 related modules are active such as IP and DHCP statistics.&lt;br /&gt;
* Up to Layer 4: Additionally all Layer 4 related modules are active such as TCP and Layer 4 server ports.&lt;br /&gt;
* Unlimited: All modules are active.&lt;br /&gt;
&lt;br /&gt;
When switching to another mode you need to restart the processing in order to activate the new settings.&lt;br /&gt;
&lt;br /&gt;
=== Graph detail settings ===&lt;br /&gt;
&lt;br /&gt;
It is possible to modify the detail level of all graphs in the interface. This settings allow you to see a more detailed view (with higher time resolution) or to reduce the detail level so more data can be stored on the device. Changing the default values has an impact on the performance and memory usage. Changing a slider to the left increases the detail level of graphs, but increases memory usage and decreases performance.&lt;br /&gt;
&lt;br /&gt;
* Best graph resolution: This option configures how detailed the graph information are shown in the best case (the latest information). The default value is one second which means that a graph sample point represents a second of packet time. You can change the resolution up to 1 millisecond which gives a detailed sub-second representation of the traffic. You can also decide to decrease the resolution which enables the Multimeter to store more data for a longer period of time.&lt;br /&gt;
&lt;br /&gt;
* Reduce graph resolution of old data by up to: The resolution of older graph data is automatically reduced to save memory and to allow a longer view into the traffic history. This option allows you to change this behaviour. With a reduction factor of 1/1 no reduction is done at all which means the selected graph resolution is available for the complete time. &lt;br /&gt;
:This reduces the time period to see historical data. You can choose to increase the reduction factor to store more data for a longer period. The time printed in parentheses represents the worst-case graph resolution based on the chosen resolution and reduction factor.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Note: Regardless of these settings, the graph values are always converted to represent a value per second (when applicable). For example, the packets per second for IP addresses will always be a value literally per second even if the resolution is larger or smaller than one second. The displayed value is scaled to match this view. Especially with sub-second resolution this might be misleading. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
For instance, if there is a network element sending one packet per second and the resolution is set to 100 milliseconds, the value might be shown as 10 packets per second as each sample point is scaled to represent an value per second. For a detailed investigation it is recommended to select a specific time interval since the total packet counters shown in all statistics are unscaled and represent the actual values.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Performance implications: The performance degradation and memory usage depends on the actual network traffic and is not exactly predictable. &lt;br /&gt;
&lt;br /&gt;
Here are some examples for reference on a Multimeter 1000 series with different configuration values (under ideal test conditions):&lt;br /&gt;
&lt;br /&gt;
* 1 second resolution, 1/1 reduction factor: 90% of default performance&lt;br /&gt;
* 100 millisecond resolution, 1/1 reduction factor: 50% of default performance,&lt;br /&gt;
* 10 millisecond resolution, 1/1 reduction factor: 15% of default performance&lt;br /&gt;
* 1 millisecond resolution, 1/1 reduction factor: 10% of default performance&lt;br /&gt;
&lt;br /&gt;
=== pcap parallel analysis ===&lt;br /&gt;
&lt;br /&gt;
The pcap parallel analysis feature allows to analyse pcap files or the&lt;br /&gt;
packet ring buffer in parallel to the live measurement. The settings&lt;br /&gt;
allow to enable the feature and choose how much memory of the main&lt;br /&gt;
memory is used for parallel analysis and how many parallel slots can&lt;br /&gt;
be used. Detailed description of the configuration values are&lt;br /&gt;
described [[pcap parallel analysis|here]].&lt;br /&gt;
&lt;br /&gt;
== IPFIX settings ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter may be running as an IPFIX exporter. These settings allows for reporting configuration. When enabled, the following settings are possible:&lt;br /&gt;
&lt;br /&gt;
* IP address: Address of IPFIX collector.&lt;br /&gt;
* Port: Corresponding port.&lt;br /&gt;
* Protocol: TCP or UDP.&lt;br /&gt;
* Update interval: Interval in seconds for sending a status update of flows.&lt;br /&gt;
* UDP resend interval: Interval in seconds for resending IPFIX templates for UDP connections.&lt;br /&gt;
* TCP reconnect timeout: When TCP connections could not be established, wait for this time period until the next attempt to establish a connection.&lt;br /&gt;
&lt;br /&gt;
Individual IPFIX messages can be enabled or disabled by toggling corresponding options. See the NetFlow/IPFIX interface documentation for details about the message types.&lt;br /&gt;
&lt;br /&gt;
== Time settings ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can be configured to use a time synchronization service. NTP is supported for all variants of the Multimeter. PTP service may be used if management interface supports hardware time stamping.&lt;br /&gt;
If a GPS-capable PTP grandmaster card is available, GPS time synchronization is available and the antenna cable delay in nanoseconds can be configured.&lt;br /&gt;
&lt;br /&gt;
To enable a time service, switch to the proper type in the dropdown box.&lt;br /&gt;
The time service field will show whether the selected service is running or not.&lt;br /&gt;
For NTP time retrieval you can specify and edit dedicated NTP servers. If you do not specify a NTP server, a set of predefined NTP servers will be automatically selected.&lt;br /&gt;
For PTP time retrieval, the PTP grandmaster clock identity is shown. This is usually an EUI-64 address. The first and last set of octets of the identity represent the (EUI-48) MAC address of the grandmaster.&lt;br /&gt;
&lt;br /&gt;
The following settings are possible for PTP and should match the settings of the PTP grandmaster:&lt;br /&gt;
&lt;br /&gt;
* Delay mechanism: Use end-to-end (E2E), peer-to-peer (P2P) or automatic delay measurement. In case automatic measurement is selected, E2E is used at the beginning and switched to P2P when a peer delay request is received. Default is &#039;&#039;&#039;Auto&#039;&#039;&#039;.&lt;br /&gt;
* Network transport: Use UDPv4, UDPv6 or Layer 2 as network transport. Default is &#039;&#039;&#039;UDPv4&#039;&#039;&#039;.&lt;br /&gt;
* Domain number: The domain number of the grandmaster. This is used to define logical groups of synchronized clocks.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The GPS time retrieval option is available if a GPS capable PTP grandmaster card is installed in the Multimeter. &lt;br /&gt;
If no time synchronization mechanism is selected the date and time of the device can be manually configured by entering a properly formatted date and time description.&lt;br /&gt;
Below the time synchronization settings, the time zone used by the device can be configured. The drop-down list provides a list of cities grouped by world regions to select the appropriate time zone.&lt;br /&gt;
To make changes take effect, click on the Save settings button at the bottom of the page. To reload the stored settings, click on Reload settings.&lt;br /&gt;
&lt;br /&gt;
== Email notification ==&lt;br /&gt;
&lt;br /&gt;
Certain modules support the sending of email notifications. The following settings are used to globally configure the SMTP server used  and the target email address that will receive the notifications:&lt;br /&gt;
&lt;br /&gt;
* Enable email notifications: globally enables or disables the sending of email notifications.&lt;br /&gt;
* SMTP server address: the address of the SMTP server that will be used to send notification emails.&lt;br /&gt;
* SMTP server port: the TCP port on which the SMTP server is listening.&lt;br /&gt;
* SMTP server uses SSL: must be set to On if the SMTP server expects an SSL connection from the very start. If the SMTP server uses no SSL or STARTTLS this setting must be set to Off.&lt;br /&gt;
* Ignore certificate errors: if the SSL certificate should not be validated because e.g. it is a self-signed certificate this setting can be used to turn off certificate validation.&lt;br /&gt;
* Allow unencrypted connections: if an unencrypted connection must be allowed because e.g. a legacy SMTP server does not support it this setting can be used.&lt;br /&gt;
* Username: the username used to log in to the SMTP server.&lt;br /&gt;
* Password: the password used to log in to the SMTP server.&lt;br /&gt;
* From email address: the email address from which incident notifications will be sent.&lt;br /&gt;
* Target email address: the email address to which incident notifications will be sent.&lt;br /&gt;
* Email links base URL: this base URL will be used to generate the HTML links in notification emails. Since the device cannot by itself determine the proper address by which it is visible to the email recipient this setting can be used to set the correct URL prefix for links sent with the notification emails.&lt;br /&gt;
* Send periodic system status mail: if set to hourly or daily, a system status email will be sent to the configured target address with the selected frequency. It will contain basic system information and system health status, management interface configuration and a list of detected LLDP neighbours if the management LLDP feature is enabled.&lt;br /&gt;
&lt;br /&gt;
The Send test email button can be used to verify that the entered settings are working.&lt;br /&gt;
&lt;br /&gt;
== Expert settings ==&lt;br /&gt;
&lt;br /&gt;
The Expert settings contains parameter which are often only necessary to change in rare installation scenarios or some specific need for a different operation mode.&lt;br /&gt;
&lt;br /&gt;
=== Packet length accounting ===&lt;br /&gt;
&lt;br /&gt;
This setting allows to configure which packet length is used for all traffic counters and incidents. Following modes are possible:&lt;br /&gt;
&lt;br /&gt;
* Layer 1: Packet length is accounted on layer 1 including preamble (7 Byte), SFD (1 Byte) and inter frame gap (12 Byte)&lt;br /&gt;
* Layer 2 without frame check sequence (default): Packet length is accounted on layer 2 without frame check sequence (4 Byte)&lt;br /&gt;
* Layer 2 with frame check sequence: Account packet length on layer 2 with frame check sequence (4 Byte) When switching to another mode, it will only be applied on new packets. Older packet size statistics will not be changed.&lt;br /&gt;
&lt;br /&gt;
=== VLAN handling ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can ignore VLAN tags for connection tracking. Enabling this option might be necessary if network traffic is seen on the Network Multimeter that contains changing VLAN tags for the same connection. For example, depending on the configuration of the mirror port to which the Network Multimeter is connected, incoming traffic could contain a VLAN tag while outgoing traffic does not. In this example, a connection would appear two times in the statistics which is often the desired behavior to be able to identify a network misconfiguration. But sometimes this behavior is intended and the user want to see only one connection. In this scenario the option can be enabled to ignore varying VLAN tags for a otherwise identical connection.&lt;br /&gt;
&lt;br /&gt;
=== Tunnel view mode ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can decapsulate ERSPAN type II and type III traffic. In this mode all non-ERSPAN traffic is being discarded. On the dashboard a dropped counter will display dropped non ERSPAN packets for indication if this mode is active. The Multimeter will show the encapsulated content in all analysis modules. When capturing, packets with complete outer layer 2, layer 3, GRE and ERSPAN headers will be stored as seen on the wire.&lt;br /&gt;
&lt;br /&gt;
=== Database mode settings ===&lt;br /&gt;
&lt;br /&gt;
The database mode is a special analysis mode for high-performance Network Multimeters with multiple processors to increase the performance on such systems. It is normally enabled automatically but depending on the actual network traffic and system usage, some parameter tweak might be necessary to improve overall system performance. &lt;br /&gt;
You should only change these parameters in discussion with the Allegro Packets support.&lt;br /&gt;
These settings are only visible if your Network Multimeter is capable of running this mode.&lt;br /&gt;
&lt;br /&gt;
You can read more about the meaning of the settings [[DB mode|here]].&lt;br /&gt;
&lt;br /&gt;
=== Network performance ===&lt;br /&gt;
&lt;br /&gt;
There are several network performance settings available to improve performance on high-performance systems in case of packet drops during very high receive bandwidth. They are only visible if your Network Multimeter is capable of changing these settings.&lt;br /&gt;
&lt;br /&gt;
* Max RX queues per socket: This setting specifies the amount of threads dedicated to read and write interactions with the network interface controllers. By increasing this value, network receive bandwidth can be increased before packet drops occur. By decreasing this value, data analysis will improve. The default setting of 2 RX queues is suitable for most configurations as data analysis typically needs much more processing ressources.&lt;br /&gt;
* Use Hyper-Threading for RX queues: This setting allows enabling or disabling Hyper-Threading for the threads dedicated to read and write interactions with the network interface controllers. By disabling it, network performance can be improved as the RX queues will be distributed to physical CPU cores only. By enabling it, RX queues will also be distributed to virtual Hyper-Threading CPU cores which is not as efficient as physical CPU cores. By using Hyper-Threading, data analysis will improve as there are more CPU cores available for these tasks. Hyper-Threading is used by default. This is suitable for most configurations as data analysis typically needs much more processing ressources.&lt;br /&gt;
* Preferred Network interface controller: This setting allows fine tuning of network and data analysis performance for dedicated network controllers. The selected set of network controllers will be preferred over the others. Usually the fastest or the network controller with the most traffic should be preferred. The &#039;&#039;&#039;Auto&#039;&#039;&#039; setting is used by default, preferring the fastest network controller.&lt;br /&gt;
&lt;br /&gt;
You should only change these parameters in discussion with the Allegro Packets support.&lt;br /&gt;
&lt;br /&gt;
=== Processing performance ===&lt;br /&gt;
&lt;br /&gt;
The processing performance may be modified on high-performance systems. This is only visible if your Network Multimeter is capable of changing this setting.&lt;br /&gt;
&lt;br /&gt;
* Processing performance mode: This setting allows for fine tuning processing performance. By using &#039;&#039;&#039;Analysing&#039;&#039;&#039;, as much processing ressources on all CPUs as possible are used for data analysis. By using &#039;&#039;&#039;Capturing&#039;&#039;&#039;, the focus will be on high data throughput and low latency for capturing purposes by using only the CPU where the preferred newtork controller is attached to. This has an impact on data analysis performance. &#039;&#039;&#039;Analysing&#039;&#039;&#039; is used by default.&lt;br /&gt;
You should only change this parameter in discussion with the Allegro Packets support.&lt;br /&gt;
&lt;br /&gt;
=== Packet ring buffer timeouts ===&lt;br /&gt;
&lt;br /&gt;
Two timeout settings related to the packet ring buffer can be adjusted.&lt;br /&gt;
&lt;br /&gt;
* The long timeout controls after which maximum period of time a packet is actually written to the packet ring buffer. A lower value may decrease the time difference by which packets are stored out of their real order in the packet ring buffer but it may also increase the amount of unused overhead data in the packet ring buffer.&lt;br /&gt;
* The short timeout controls after which period of time smaller batches of packets are written to the packet ring buffer even if waiting for more packets would result in a more efficient operation. A lower value may decrease the time difference by which packets are stored out of their real order in the packet ring buffer but it may also decrease the performance of the packet ring buffer.&lt;br /&gt;
&lt;br /&gt;
=== Data retention timeout ===&lt;br /&gt;
&lt;br /&gt;
When this timeout is set to a value greater than 0, data will be removed from the system after the given number of minutes. This means that entities like IPs, which have been inactive for longer than the timeout, will be removed. History graph data for entities that are still active will be truncated to cover only the given timespan while the absolute values for the whole runtime will be retained. When a packet ring buffer is active, packets which are older than the timeout will be discarded.&lt;br /&gt;
&lt;br /&gt;
=== L3 tunnel mode ===&lt;br /&gt;
&lt;br /&gt;
If L3 tunnel mode is enabled for an interface this interface will only process packets encapsulated in GRE or GRE+ERSPAN and targeted for the configured IP address. All other packets received on that interface will be discarded. The system will process the packets as if only the inner encapsulated packet is seen and any traffic captures will only contain the encapsulated packet. An interface with L3 tunnel mode enabled will respond to ARP requests and to ICMP echo requests so it is possible to use ping to verify that the interface is reachable under the configured IP address. Currently only IPv4 L3 tunnels are supported. It must be noted that if the system is running in bridge packet processing mode any links with an interface configured for L3 tunnel mode will not forward traffic.&lt;br /&gt;
&lt;br /&gt;
=== Multithreaded capture analysis ===&lt;br /&gt;
&lt;br /&gt;
This option enables the use of multiple CPUs for capture analysis like when&lt;br /&gt;
analyzing a PCAP capture file or analyzing the packet ring buffer. Depending&lt;br /&gt;
on the number of available CPUs this can speed up the analysis significantly.&lt;br /&gt;
&lt;br /&gt;
It is possible to dedicate a number a CPUs exclusively to capture analysis.&lt;br /&gt;
Since these CPUs are not available for live packet processing the performance of&lt;br /&gt;
live traffic analysis may be lower.&lt;br /&gt;
When set to 0 a lower priority is used for capture analysis than for live analysis&lt;br /&gt;
but it cannot be ruled out that the performance of the live processing is&lt;br /&gt;
affected.&lt;br /&gt;
&lt;br /&gt;
=== Load balancing ===&lt;br /&gt;
&lt;br /&gt;
This option select the load distribution method. By default, network&lt;br /&gt;
traffic is balanced among all processing threads based on the IP&lt;br /&gt;
addresses. This is fast and usually the best way for good load&lt;br /&gt;
balancing.&lt;br /&gt;
&lt;br /&gt;
If the network traffic only happens between few IP addresses, this&lt;br /&gt;
method can lead to load imbalance so that some threads doing much more&lt;br /&gt;
work while other threads may idle. In this scenario the &amp;quot;flow based&lt;br /&gt;
balancing&amp;quot; can be enabled to distribute the traffic based on the IP&lt;br /&gt;
and port information. This will lead to better utilization of all&lt;br /&gt;
processing threads.&lt;br /&gt;
&lt;br /&gt;
Since this option induces additional processing overhead per packet&lt;br /&gt;
and additional memory for all internal IP statistics, it should only&lt;br /&gt;
be enabled in cases of significant load imbalance.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Global_settings&amp;diff=2844</id>
		<title>Global settings</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Global_settings&amp;diff=2844"/>
		<updated>2020-05-22T15:14:58Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* Time settings */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;The Global settings section contains parameters for adjusting the behavior of the system.&lt;br /&gt;
The settings are split among multiple tabs, described as follows.&lt;br /&gt;
&lt;br /&gt;
== Generic settings ==&lt;br /&gt;
&lt;br /&gt;
=== Packet processing mode ===&lt;br /&gt;
&lt;br /&gt;
This section allows for configuring the main packet processing mode:&lt;br /&gt;
&lt;br /&gt;
* Bridge mode: In Bridge mode, all received packets will be retransmitted on the corresponding mutual port so that the device can be placed inline between any network component. The device will be transparent and will not modify the traffic in any way. The additional latency will be typically around or less than 1 millisecond.&lt;br /&gt;
* Sink mode: In Sink mode, packets are only received and not forwarded. This operation mode allows for installation at a Mirror port of a Switch or when using a network Tap to access the network traffic.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The packet processing mode can be changed during runtime.&lt;br /&gt;
&lt;br /&gt;
=== Webshark support ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter allows having a preview of the first Megabyte of packets directly in the browser, called Webshark. To support this, the device needs a small amount of system memory for packet processing. This amount of memory (~100MB) will be reserved by the Multimeter and is not available for the In-Memory database used to store metadata, thus the history of stored metadata is a little shorter. If this is not desired, it is possible to disable the Webshark support. Changing this value requires a restart of the processing.&lt;br /&gt;
&lt;br /&gt;
=== Limit module processing ===&lt;br /&gt;
&lt;br /&gt;
This setting allows you to configure which modules are active. With this setting, the performance of the Allegro Network Multimeter can be significantly improved and allows a higher throughput if you do not need to select some analysis modules.&lt;br /&gt;
&lt;br /&gt;
The following modes are possible:&lt;br /&gt;
&lt;br /&gt;
* Only capturing: Only interface statistics and the capture module is provided. The capture filters are supported except Layer 7 protocol recognition.&lt;br /&gt;
* Up to Layer 2: Additionally all Layer 2 related modules are active such as MAC, MAC protocols, ARP and Burst Analysis.&lt;br /&gt;
* Up to Layer 3: Additionally all Layer 3 related modules are active such as IP and DHCP statistics.&lt;br /&gt;
* Up to Layer 4: Additionally all Layer 4 related modules are active such as TCP and Layer 4 server ports.&lt;br /&gt;
* Unlimited: All modules are active.&lt;br /&gt;
&lt;br /&gt;
When switching to another mode you need to restart the processing in order to activate the new settings.&lt;br /&gt;
&lt;br /&gt;
=== Graph detail settings ===&lt;br /&gt;
&lt;br /&gt;
It is possible to modify the detail level of all graphs in the interface. This settings allow you to see a more detailed view (with higher time resolution) or to reduce the detail level so more data can be stored on the device. Changing the default values has an impact on the performance and memory usage. Changing a slider to the left increases the detail level of graphs, but increases memory usage and decreases performance.&lt;br /&gt;
&lt;br /&gt;
* Best graph resolution: This option configures how detailed the graph information are shown in the best case (the latest information). The default value is one second which means that a graph sample point represents a second of packet time. You can change the resolution up to 1 millisecond which gives a detailed sub-second representation of the traffic. You can also decide to decrease the resolution which enables the Multimeter to store more data for a longer period of time.&lt;br /&gt;
&lt;br /&gt;
* Reduce graph resolution of old data by up to: The resolution of older graph data is automatically reduced to save memory and to allow a longer view into the traffic history. This option allows you to change this behaviour. With a reduction factor of 1/1 no reduction is done at all which means the selected graph resolution is available for the complete time. &lt;br /&gt;
:This reduces the time period to see historical data. You can choose to increase the reduction factor to store more data for a longer period. The time printed in parentheses represents the worst-case graph resolution based on the chosen resolution and reduction factor.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Note: Regardless of these settings, the graph values are always converted to represent a value per second (when applicable). For example, the packets per second for IP addresses will always be a value literally per second even if the resolution is larger or smaller than one second. The displayed value is scaled to match this view. Especially with sub-second resolution this might be misleading. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
For instance, if there is a network element sending one packet per second and the resolution is set to 100 milliseconds, the value might be shown as 10 packets per second as each sample point is scaled to represent an value per second. For a detailed investigation it is recommended to select a specific time interval since the total packet counters shown in all statistics are unscaled and represent the actual values.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Performance implications: The performance degradation and memory usage depends on the actual network traffic and is not exactly predictable. &lt;br /&gt;
&lt;br /&gt;
Here are some examples for reference on a Multimeter 1000 series with different configuration values (under ideal test conditions):&lt;br /&gt;
&lt;br /&gt;
* 1 second resolution, 1/1 reduction factor: 90% of default performance&lt;br /&gt;
* 100 millisecond resolution, 1/1 reduction factor: 50% of default performance,&lt;br /&gt;
* 10 millisecond resolution, 1/1 reduction factor: 15% of default performance&lt;br /&gt;
* 1 millisecond resolution, 1/1 reduction factor: 10% of default performance&lt;br /&gt;
&lt;br /&gt;
=== pcap parallel analysis ===&lt;br /&gt;
&lt;br /&gt;
The pcap parallel analysis feature allows to analyse pcap files or the&lt;br /&gt;
packet ring buffer in parallel to the live measurement. The settings&lt;br /&gt;
allow to enable the feature and choose how much memory of the main&lt;br /&gt;
memory is used for parallel analysis and how many parallel slots can&lt;br /&gt;
be used. Detailed description of the configuration values are&lt;br /&gt;
described [[pcap parallel analysis|here]].&lt;br /&gt;
&lt;br /&gt;
== IPFIX settings ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter may be running as an IPFIX exporter. These settings allows for reporting configuration. When enabled, the following settings are possible:&lt;br /&gt;
&lt;br /&gt;
* IP address: Address of IPFIX collector.&lt;br /&gt;
* Port: Corresponding port.&lt;br /&gt;
* Protocol: TCP or UDP.&lt;br /&gt;
* Update interval: Interval in seconds for sending a status update of flows.&lt;br /&gt;
* UDP resend interval: Interval in seconds for resending IPFIX templates for UDP connections.&lt;br /&gt;
* TCP reconnect timeout: When TCP connections could not be established, wait for this time period until the next attempt to establish a connection.&lt;br /&gt;
&lt;br /&gt;
Individual IPFIX messages can be enabled or disabled by toggling corresponding options. See the NetFlow/IPFIX interface documentation for details about the message types.&lt;br /&gt;
&lt;br /&gt;
== Time settings ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can be configured to use a time synchronization service. NTP is supported for all variants of the Multimeter. PTP service may be used if management interface supports hardware time stamping.&lt;br /&gt;
If a GPS-capable PTP grandmaster card is available, GPS time synchronization is available and the antenna cable delay in nanoseconds can be configured.&lt;br /&gt;
&lt;br /&gt;
To enable a time service, switch to the proper type in the dropdown box.&lt;br /&gt;
The time service field will show whether the selected service is running or not.&lt;br /&gt;
For NTP time retrieval you can specify and edit dedicated NTP servers. If you do not specify a NTP server, a set of predefined NTP servers will be automatically selected.&lt;br /&gt;
For PTP time retrieval, the PTP grandmaster clock identity is shown. This is usually an EUI-64 address. The first and last set of octets of the identity represent the (EUI-48) MAC address of the grandmaster.&lt;br /&gt;
&lt;br /&gt;
The following settings are possible for PTP and should match the settings of the PTP grandmaster:&lt;br /&gt;
&lt;br /&gt;
* Delay mechanism: Use end-to-end (E2E), peer-to-peer (P2P) or automatic delay measurement. In case automatic measurement is selected, E2E is used at the beginning and switched to P2P when a peer delay request is received. Default is &#039;&#039;&#039;Auto&#039;&#039;&#039;.&lt;br /&gt;
* Network transport: Use UDPv4, UDPv6 or Layer 2 as network transport. Default is &#039;&#039;&#039;UDPv4&#039;&#039;&#039;.&lt;br /&gt;
* Domain number: The domain number of the grandmaster. This is used to define logical groups of synchronized clocks.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The GPS time retrieval option is available if a GPS capable PTP grandmaster card is installed in the Multimeter. &lt;br /&gt;
If no time synchronization mechanism is selected the date and time of the device can be manually configured by entering a properly formatted date and time description.&lt;br /&gt;
Below the time synchronization settings, the time zone used by the device can be configured. The drop-down list provides a list of cities grouped by world regions to select the appropriate time zone.&lt;br /&gt;
To make changes take effect, click on the Save settings button at the bottom of the page. To reload the stored settings, click on Reload settings.&lt;br /&gt;
&lt;br /&gt;
== Email notification ==&lt;br /&gt;
&lt;br /&gt;
Certain modules support the sending of email notifications. The following settings are used to globally configure the used SMTP server and the target email address that will receive the notifications:&lt;br /&gt;
&lt;br /&gt;
* Enable email notifications: globally enables or disables the sending of email notifications.&lt;br /&gt;
* SMTP server address: the address of the SMTP server that will be used to send out notification emails.&lt;br /&gt;
* SMTP server port: the TCP port on which the SMTP server is listening.&lt;br /&gt;
* SMTP server uses SSL: must be set to On if the SMTP server expects an SSL connection from the very start. If the SMTP server uses no SSL or STARTTLS this setting must be set to Off.&lt;br /&gt;
* Ignore certificate errors: if the SSL certificate should not be validated because e.g. it is a self-signed certificate this setting can be used to turn off certificate validation.&lt;br /&gt;
* Allow unencrypted connections: if an unencrypted connection must be allowed because e.g. a legacy SMTP server does not support it this setting can be used.&lt;br /&gt;
* Username: the username used to log in to the SMTP server.&lt;br /&gt;
* Password: the password used to log in to the SMTP server.&lt;br /&gt;
* From email address: the email address from which incident notifications will be sent.&lt;br /&gt;
* Target email address: the email address to which incident notifications will be sent.&lt;br /&gt;
* Email links base URL: this base URL will be used to generate the HTML links in notification emails. Since the device cannot by itself determine the proper address by which it is visible to the email recipient this setting can be used to set the right URL prefix for links sent with the notification emails.&lt;br /&gt;
* Send periodic system status mail: if set to hourly or daily a system status email will be sent to the configured target address with the selected frequency. It will contain basic system information and system health status, management interface configuration and a list of detected LLDP neighbors if the management LLDP feature is enabled.&lt;br /&gt;
&lt;br /&gt;
The Send test email button can be used to verify that the entered settings are working.&lt;br /&gt;
&lt;br /&gt;
== Expert settings ==&lt;br /&gt;
&lt;br /&gt;
The Expert settings contains parameter which are often only necessary to change in rare installation scenarios or some specific need for a different operation mode.&lt;br /&gt;
&lt;br /&gt;
=== Packet length accounting ===&lt;br /&gt;
&lt;br /&gt;
This setting allows to configure which packet length is used for all traffic counters and incidents. Following modes are possible:&lt;br /&gt;
&lt;br /&gt;
* Layer 1: Packet length is accounted on layer 1 including preamble (7 Byte), SFD (1 Byte) and inter frame gap (12 Byte)&lt;br /&gt;
* Layer 2 without frame check sequence (default): Packet length is accounted on layer 2 without frame check sequence (4 Byte)&lt;br /&gt;
* Layer 2 with frame check sequence: Account packet length on layer 2 with frame check sequence (4 Byte) When switching to another mode, it will only be applied on new packets. Older packet size statistics will not be changed.&lt;br /&gt;
&lt;br /&gt;
=== VLAN handling ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can ignore VLAN tags for connection tracking. Enabling this option might be necessary if network traffic is seen on the Network Multimeter that contains changing VLAN tags for the same connection. For example, depending on the configuration of the mirror port to which the Network Multimeter is connected, incoming traffic could contain a VLAN tag while outgoing traffic does not. In this example, a connection would appear two times in the statistics which is often the desired behavior to be able to identify a network misconfiguration. But sometimes this behavior is intended and the user want to see only one connection. In this scenario the option can be enabled to ignore varying VLAN tags for a otherwise identical connection.&lt;br /&gt;
&lt;br /&gt;
=== Tunnel view mode ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can decapsulate ERSPAN type II and type III traffic. In this mode all non-ERSPAN traffic is being discarded. On the dashboard a dropped counter will display dropped non ERSPAN packets for indication if this mode is active. The Multimeter will show the encapsulated content in all analysis modules. When capturing, packets with complete outer layer 2, layer 3, GRE and ERSPAN headers will be stored as seen on the wire.&lt;br /&gt;
&lt;br /&gt;
=== Database mode settings ===&lt;br /&gt;
&lt;br /&gt;
The database mode is a special analysis mode for high-performance Network Multimeters with multiple processors to increase the performance on such systems. It is normally enabled automatically but depending on the actual network traffic and system usage, some parameter tweak might be necessary to improve overall system performance. &lt;br /&gt;
You should only change these parameters in discussion with the Allegro Packets support.&lt;br /&gt;
These settings are only visible if your Network Multimeter is capable of running this mode.&lt;br /&gt;
&lt;br /&gt;
You can read more about the meaning of the settings [[DB mode|here]].&lt;br /&gt;
&lt;br /&gt;
=== Network performance ===&lt;br /&gt;
&lt;br /&gt;
There are several network performance settings available to improve performance on high-performance systems in case of packet drops during very high receive bandwidth. They are only visible if your Network Multimeter is capable of changing these settings.&lt;br /&gt;
&lt;br /&gt;
* Max RX queues per socket: This setting specifies the amount of threads dedicated to read and write interactions with the network interface controllers. By increasing this value, network receive bandwidth can be increased before packet drops occur. By decreasing this value, data analysis will improve. The default setting of 2 RX queues is suitable for most configurations as data analysis typically needs much more processing ressources.&lt;br /&gt;
* Use Hyper-Threading for RX queues: This setting allows enabling or disabling Hyper-Threading for the threads dedicated to read and write interactions with the network interface controllers. By disabling it, network performance can be improved as the RX queues will be distributed to physical CPU cores only. By enabling it, RX queues will also be distributed to virtual Hyper-Threading CPU cores which is not as efficient as physical CPU cores. By using Hyper-Threading, data analysis will improve as there are more CPU cores available for these tasks. Hyper-Threading is used by default. This is suitable for most configurations as data analysis typically needs much more processing ressources.&lt;br /&gt;
* Preferred Network interface controller: This setting allows fine tuning of network and data analysis performance for dedicated network controllers. The selected set of network controllers will be preferred over the others. Usually the fastest or the network controller with the most traffic should be preferred. The &#039;&#039;&#039;Auto&#039;&#039;&#039; setting is used by default, preferring the fastest network controller.&lt;br /&gt;
&lt;br /&gt;
You should only change these parameters in discussion with the Allegro Packets support.&lt;br /&gt;
&lt;br /&gt;
=== Processing performance ===&lt;br /&gt;
&lt;br /&gt;
The processing performance may be modified on high-performance systems. This is only visible if your Network Multimeter is capable of changing this setting.&lt;br /&gt;
&lt;br /&gt;
* Processing performance mode: This setting allows for fine tuning processing performance. By using &#039;&#039;&#039;Analysing&#039;&#039;&#039;, as much processing ressources on all CPUs as possible are used for data analysis. By using &#039;&#039;&#039;Capturing&#039;&#039;&#039;, the focus will be on high data throughput and low latency for capturing purposes by using only the CPU where the preferred newtork controller is attached to. This has an impact on data analysis performance. &#039;&#039;&#039;Analysing&#039;&#039;&#039; is used by default.&lt;br /&gt;
You should only change this parameter in discussion with the Allegro Packets support.&lt;br /&gt;
&lt;br /&gt;
=== Packet ring buffer timeouts ===&lt;br /&gt;
&lt;br /&gt;
Two timeout settings related to the packet ring buffer can be adjusted.&lt;br /&gt;
&lt;br /&gt;
* The long timeout controls after which maximum period of time a packet is actually written to the packet ring buffer. A lower value may decrease the time difference by which packets are stored out of their real order in the packet ring buffer but it may also increase the amount of unused overhead data in the packet ring buffer.&lt;br /&gt;
* The short timeout controls after which period of time smaller batches of packets are written to the packet ring buffer even if waiting for more packets would result in a more efficient operation. A lower value may decrease the time difference by which packets are stored out of their real order in the packet ring buffer but it may also decrease the performance of the packet ring buffer.&lt;br /&gt;
&lt;br /&gt;
=== Data retention timeout ===&lt;br /&gt;
&lt;br /&gt;
When this timeout is set to a value greater than 0, data will be removed from the system after the given number of minutes. This means that entities like IPs, which have been inactive for longer than the timeout, will be removed. History graph data for entities that are still active will be truncated to cover only the given timespan while the absolute values for the whole runtime will be retained. When a packet ring buffer is active, packets which are older than the timeout will be discarded.&lt;br /&gt;
&lt;br /&gt;
=== L3 tunnel mode ===&lt;br /&gt;
&lt;br /&gt;
If L3 tunnel mode is enabled for an interface this interface will only process packets encapsulated in GRE or GRE+ERSPAN and targeted for the configured IP address. All other packets received on that interface will be discarded. The system will process the packets as if only the inner encapsulated packet is seen and any traffic captures will only contain the encapsulated packet. An interface with L3 tunnel mode enabled will respond to ARP requests and to ICMP echo requests so it is possible to use ping to verify that the interface is reachable under the configured IP address. Currently only IPv4 L3 tunnels are supported. It must be noted that if the system is running in bridge packet processing mode any links with an interface configured for L3 tunnel mode will not forward traffic.&lt;br /&gt;
&lt;br /&gt;
=== Multithreaded capture analysis ===&lt;br /&gt;
&lt;br /&gt;
This option enables the use of multiple CPUs for capture analysis like when&lt;br /&gt;
analyzing a PCAP capture file or analyzing the packet ring buffer. Depending&lt;br /&gt;
on the number of available CPUs this can speed up the analysis significantly.&lt;br /&gt;
&lt;br /&gt;
It is possible to dedicate a number a CPUs exclusively to capture analysis.&lt;br /&gt;
Since these CPUs are not available for live packet processing the performance of&lt;br /&gt;
live traffic analysis may be lower.&lt;br /&gt;
When set to 0 a lower priority is used for capture analysis than for live analysis&lt;br /&gt;
but it cannot be ruled out that the performance of the live processing is&lt;br /&gt;
affected.&lt;br /&gt;
&lt;br /&gt;
=== Load balancing ===&lt;br /&gt;
&lt;br /&gt;
This option select the load distribution method. By default, network&lt;br /&gt;
traffic is balanced among all processing threads based on the IP&lt;br /&gt;
addresses. This is fast and usually the best way for good load&lt;br /&gt;
balancing.&lt;br /&gt;
&lt;br /&gt;
If the network traffic only happens between few IP addresses, this&lt;br /&gt;
method can lead to load imbalance so that some threads doing much more&lt;br /&gt;
work while other threads may idle. In this scenario the &amp;quot;flow based&lt;br /&gt;
balancing&amp;quot; can be enabled to distribute the traffic based on the IP&lt;br /&gt;
and port information. This will lead to better utilization of all&lt;br /&gt;
processing threads.&lt;br /&gt;
&lt;br /&gt;
Since this option induces additional processing overhead per packet&lt;br /&gt;
and additional memory for all internal IP statistics, it should only&lt;br /&gt;
be enabled in cases of significant load imbalance.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Global_settings&amp;diff=2843</id>
		<title>Global settings</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Global_settings&amp;diff=2843"/>
		<updated>2020-05-22T15:11:45Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* IPFIX settings */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;The Global settings section contains parameters for adjusting the behavior of the system.&lt;br /&gt;
The settings are split among multiple tabs, described as follows.&lt;br /&gt;
&lt;br /&gt;
== Generic settings ==&lt;br /&gt;
&lt;br /&gt;
=== Packet processing mode ===&lt;br /&gt;
&lt;br /&gt;
This section allows for configuring the main packet processing mode:&lt;br /&gt;
&lt;br /&gt;
* Bridge mode: In Bridge mode, all received packets will be retransmitted on the corresponding mutual port so that the device can be placed inline between any network component. The device will be transparent and will not modify the traffic in any way. The additional latency will be typically around or less than 1 millisecond.&lt;br /&gt;
* Sink mode: In Sink mode, packets are only received and not forwarded. This operation mode allows for installation at a Mirror port of a Switch or when using a network Tap to access the network traffic.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The packet processing mode can be changed during runtime.&lt;br /&gt;
&lt;br /&gt;
=== Webshark support ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter allows having a preview of the first Megabyte of packets directly in the browser, called Webshark. To support this, the device needs a small amount of system memory for packet processing. This amount of memory (~100MB) will be reserved by the Multimeter and is not available for the In-Memory database used to store metadata, thus the history of stored metadata is a little shorter. If this is not desired, it is possible to disable the Webshark support. Changing this value requires a restart of the processing.&lt;br /&gt;
&lt;br /&gt;
=== Limit module processing ===&lt;br /&gt;
&lt;br /&gt;
This setting allows you to configure which modules are active. With this setting, the performance of the Allegro Network Multimeter can be significantly improved and allows a higher throughput if you do not need to select some analysis modules.&lt;br /&gt;
&lt;br /&gt;
The following modes are possible:&lt;br /&gt;
&lt;br /&gt;
* Only capturing: Only interface statistics and the capture module is provided. The capture filters are supported except Layer 7 protocol recognition.&lt;br /&gt;
* Up to Layer 2: Additionally all Layer 2 related modules are active such as MAC, MAC protocols, ARP and Burst Analysis.&lt;br /&gt;
* Up to Layer 3: Additionally all Layer 3 related modules are active such as IP and DHCP statistics.&lt;br /&gt;
* Up to Layer 4: Additionally all Layer 4 related modules are active such as TCP and Layer 4 server ports.&lt;br /&gt;
* Unlimited: All modules are active.&lt;br /&gt;
&lt;br /&gt;
When switching to another mode you need to restart the processing in order to activate the new settings.&lt;br /&gt;
&lt;br /&gt;
=== Graph detail settings ===&lt;br /&gt;
&lt;br /&gt;
It is possible to modify the detail level of all graphs in the interface. This settings allow you to see a more detailed view (with higher time resolution) or to reduce the detail level so more data can be stored on the device. Changing the default values has an impact on the performance and memory usage. Changing a slider to the left increases the detail level of graphs, but increases memory usage and decreases performance.&lt;br /&gt;
&lt;br /&gt;
* Best graph resolution: This option configures how detailed the graph information are shown in the best case (the latest information). The default value is one second which means that a graph sample point represents a second of packet time. You can change the resolution up to 1 millisecond which gives a detailed sub-second representation of the traffic. You can also decide to decrease the resolution which enables the Multimeter to store more data for a longer period of time.&lt;br /&gt;
&lt;br /&gt;
* Reduce graph resolution of old data by up to: The resolution of older graph data is automatically reduced to save memory and to allow a longer view into the traffic history. This option allows you to change this behaviour. With a reduction factor of 1/1 no reduction is done at all which means the selected graph resolution is available for the complete time. &lt;br /&gt;
:This reduces the time period to see historical data. You can choose to increase the reduction factor to store more data for a longer period. The time printed in parentheses represents the worst-case graph resolution based on the chosen resolution and reduction factor.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Note: Regardless of these settings, the graph values are always converted to represent a value per second (when applicable). For example, the packets per second for IP addresses will always be a value literally per second even if the resolution is larger or smaller than one second. The displayed value is scaled to match this view. Especially with sub-second resolution this might be misleading. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
For instance, if there is a network element sending one packet per second and the resolution is set to 100 milliseconds, the value might be shown as 10 packets per second as each sample point is scaled to represent an value per second. For a detailed investigation it is recommended to select a specific time interval since the total packet counters shown in all statistics are unscaled and represent the actual values.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Performance implications: The performance degradation and memory usage depends on the actual network traffic and is not exactly predictable. &lt;br /&gt;
&lt;br /&gt;
Here are some examples for reference on a Multimeter 1000 series with different configuration values (under ideal test conditions):&lt;br /&gt;
&lt;br /&gt;
* 1 second resolution, 1/1 reduction factor: 90% of default performance&lt;br /&gt;
* 100 millisecond resolution, 1/1 reduction factor: 50% of default performance,&lt;br /&gt;
* 10 millisecond resolution, 1/1 reduction factor: 15% of default performance&lt;br /&gt;
* 1 millisecond resolution, 1/1 reduction factor: 10% of default performance&lt;br /&gt;
&lt;br /&gt;
=== pcap parallel analysis ===&lt;br /&gt;
&lt;br /&gt;
The pcap parallel analysis feature allows to analyse pcap files or the&lt;br /&gt;
packet ring buffer in parallel to the live measurement. The settings&lt;br /&gt;
allow to enable the feature and choose how much memory of the main&lt;br /&gt;
memory is used for parallel analysis and how many parallel slots can&lt;br /&gt;
be used. Detailed description of the configuration values are&lt;br /&gt;
described [[pcap parallel analysis|here]].&lt;br /&gt;
&lt;br /&gt;
== IPFIX settings ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter may be running as an IPFIX exporter. These settings allows for reporting configuration. When enabled, the following settings are possible:&lt;br /&gt;
&lt;br /&gt;
* IP address: Address of IPFIX collector.&lt;br /&gt;
* Port: Corresponding port.&lt;br /&gt;
* Protocol: TCP or UDP.&lt;br /&gt;
* Update interval: Interval in seconds for sending a status update of flows.&lt;br /&gt;
* UDP resend interval: Interval in seconds for resending IPFIX templates for UDP connections.&lt;br /&gt;
* TCP reconnect timeout: When TCP connections could not be established, wait for this time period until the next attempt to establish a connection.&lt;br /&gt;
&lt;br /&gt;
Individual IPFIX messages can be enabled or disabled by toggling corresponding options. See the NetFlow/IPFIX interface documentation for details about the message types.&lt;br /&gt;
&lt;br /&gt;
== Time settings ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can be configured to use a time synchronization service. NTP is supported for all variants of the Multimeter, PTP service may be used if management interface supports hardware time stamping.&lt;br /&gt;
In case a GPS capable PTP grandmaster card is available, GPS time synchronization is available and the antenna cable delay in nanoseconds can be configured.&lt;br /&gt;
&lt;br /&gt;
To enable a time service, switch to the proper type in the dropdown box.&lt;br /&gt;
The time service field will show whether the selected service is running or not.&lt;br /&gt;
For NTP time retrieval you can specify and edit dedicated NTP servers. If you do not specify a NTP server, a set of predefined NTP servers will be taken automatically.&lt;br /&gt;
For PTP time retrieval, the PTP grandmaster clock identity is shown. This is usually an EUI-64 address. The first and last set of octets of the identity represent the (EUI-48) MAC address of the grandmaster.&lt;br /&gt;
&lt;br /&gt;
Following settings are possible for PTP and should match to the settings of the PTP grandmaster:&lt;br /&gt;
&lt;br /&gt;
* Delay mechanism: Use end-to-end (E2E), peer-to-peer (P2P) or automatic delay measurement. In case automatic measurement is selected, E2E is used at the beginning and switched to P2P when a peer delay request is received. Default is &#039;&#039;&#039;Auto&#039;&#039;&#039;.&lt;br /&gt;
* Network transport: Use UDPv4, UDPv6 or Layer 2 as network transport. Default is &#039;&#039;&#039;UDPv4&#039;&#039;&#039;.&lt;br /&gt;
* Domain number: The domain number of the grandmaster. This is used to define logical groups of synchronized clocks.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The GPS time retrieval option is available if a GPS capable PTP grandmaster card is installed in the Multimeter. &lt;br /&gt;
If no time synchronization mechanism is selected the date and time of the device can be configured manually by entering a properly formatted date and time description.&lt;br /&gt;
Below the time synchronization settings the time zone used by the device can be configured. The drop-down list provides a list of cities grouped by world regions to select the appropriate time zone from.&lt;br /&gt;
To make changes take effect, click on the Save settings button on the bottom of the page. To reload the stored settings, click on Reload settings.&lt;br /&gt;
&lt;br /&gt;
== Email notification ==&lt;br /&gt;
&lt;br /&gt;
Certain modules support the sending of email notifications. The following settings are used to globally configure the used SMTP server and the target email address that will receive the notifications:&lt;br /&gt;
&lt;br /&gt;
* Enable email notifications: globally enables or disables the sending of email notifications.&lt;br /&gt;
* SMTP server address: the address of the SMTP server that will be used to send out notification emails.&lt;br /&gt;
* SMTP server port: the TCP port on which the SMTP server is listening.&lt;br /&gt;
* SMTP server uses SSL: must be set to On if the SMTP server expects an SSL connection from the very start. If the SMTP server uses no SSL or STARTTLS this setting must be set to Off.&lt;br /&gt;
* Ignore certificate errors: if the SSL certificate should not be validated because e.g. it is a self-signed certificate this setting can be used to turn off certificate validation.&lt;br /&gt;
* Allow unencrypted connections: if an unencrypted connection must be allowed because e.g. a legacy SMTP server does not support it this setting can be used.&lt;br /&gt;
* Username: the username used to log in to the SMTP server.&lt;br /&gt;
* Password: the password used to log in to the SMTP server.&lt;br /&gt;
* From email address: the email address from which incident notifications will be sent.&lt;br /&gt;
* Target email address: the email address to which incident notifications will be sent.&lt;br /&gt;
* Email links base URL: this base URL will be used to generate the HTML links in notification emails. Since the device cannot by itself determine the proper address by which it is visible to the email recipient this setting can be used to set the right URL prefix for links sent with the notification emails.&lt;br /&gt;
* Send periodic system status mail: if set to hourly or daily a system status email will be sent to the configured target address with the selected frequency. It will contain basic system information and system health status, management interface configuration and a list of detected LLDP neighbors if the management LLDP feature is enabled.&lt;br /&gt;
&lt;br /&gt;
The Send test email button can be used to verify that the entered settings are working.&lt;br /&gt;
&lt;br /&gt;
== Expert settings ==&lt;br /&gt;
&lt;br /&gt;
The Expert settings contains parameter which are often only necessary to change in rare installation scenarios or some specific need for a different operation mode.&lt;br /&gt;
&lt;br /&gt;
=== Packet length accounting ===&lt;br /&gt;
&lt;br /&gt;
This setting allows to configure which packet length is used for all traffic counters and incidents. Following modes are possible:&lt;br /&gt;
&lt;br /&gt;
* Layer 1: Packet length is accounted on layer 1 including preamble (7 Byte), SFD (1 Byte) and inter frame gap (12 Byte)&lt;br /&gt;
* Layer 2 without frame check sequence (default): Packet length is accounted on layer 2 without frame check sequence (4 Byte)&lt;br /&gt;
* Layer 2 with frame check sequence: Account packet length on layer 2 with frame check sequence (4 Byte) When switching to another mode, it will only be applied on new packets. Older packet size statistics will not be changed.&lt;br /&gt;
&lt;br /&gt;
=== VLAN handling ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can ignore VLAN tags for connection tracking. Enabling this option might be necessary if network traffic is seen on the Network Multimeter that contains changing VLAN tags for the same connection. For example, depending on the configuration of the mirror port to which the Network Multimeter is connected, incoming traffic could contain a VLAN tag while outgoing traffic does not. In this example, a connection would appear two times in the statistics which is often the desired behavior to be able to identify a network misconfiguration. But sometimes this behavior is intended and the user want to see only one connection. In this scenario the option can be enabled to ignore varying VLAN tags for a otherwise identical connection.&lt;br /&gt;
&lt;br /&gt;
=== Tunnel view mode ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can decapsulate ERSPAN type II and type III traffic. In this mode all non-ERSPAN traffic is being discarded. On the dashboard a dropped counter will display dropped non ERSPAN packets for indication if this mode is active. The Multimeter will show the encapsulated content in all analysis modules. When capturing, packets with complete outer layer 2, layer 3, GRE and ERSPAN headers will be stored as seen on the wire.&lt;br /&gt;
&lt;br /&gt;
=== Database mode settings ===&lt;br /&gt;
&lt;br /&gt;
The database mode is a special analysis mode for high-performance Network Multimeters with multiple processors to increase the performance on such systems. It is normally enabled automatically but depending on the actual network traffic and system usage, some parameter tweak might be necessary to improve overall system performance. &lt;br /&gt;
You should only change these parameters in discussion with the Allegro Packets support.&lt;br /&gt;
These settings are only visible if your Network Multimeter is capable of running this mode.&lt;br /&gt;
&lt;br /&gt;
You can read more about the meaning of the settings [[DB mode|here]].&lt;br /&gt;
&lt;br /&gt;
=== Network performance ===&lt;br /&gt;
&lt;br /&gt;
There are several network performance settings available to improve performance on high-performance systems in case of packet drops during very high receive bandwidth. They are only visible if your Network Multimeter is capable of changing these settings.&lt;br /&gt;
&lt;br /&gt;
* Max RX queues per socket: This setting specifies the amount of threads dedicated to read and write interactions with the network interface controllers. By increasing this value, network receive bandwidth can be increased before packet drops occur. By decreasing this value, data analysis will improve. The default setting of 2 RX queues is suitable for most configurations as data analysis typically needs much more processing ressources.&lt;br /&gt;
* Use Hyper-Threading for RX queues: This setting allows enabling or disabling Hyper-Threading for the threads dedicated to read and write interactions with the network interface controllers. By disabling it, network performance can be improved as the RX queues will be distributed to physical CPU cores only. By enabling it, RX queues will also be distributed to virtual Hyper-Threading CPU cores which is not as efficient as physical CPU cores. By using Hyper-Threading, data analysis will improve as there are more CPU cores available for these tasks. Hyper-Threading is used by default. This is suitable for most configurations as data analysis typically needs much more processing ressources.&lt;br /&gt;
* Preferred Network interface controller: This setting allows fine tuning of network and data analysis performance for dedicated network controllers. The selected set of network controllers will be preferred over the others. Usually the fastest or the network controller with the most traffic should be preferred. The &#039;&#039;&#039;Auto&#039;&#039;&#039; setting is used by default, preferring the fastest network controller.&lt;br /&gt;
&lt;br /&gt;
You should only change these parameters in discussion with the Allegro Packets support.&lt;br /&gt;
&lt;br /&gt;
=== Processing performance ===&lt;br /&gt;
&lt;br /&gt;
The processing performance may be modified on high-performance systems. This is only visible if your Network Multimeter is capable of changing this setting.&lt;br /&gt;
&lt;br /&gt;
* Processing performance mode: This setting allows for fine tuning processing performance. By using &#039;&#039;&#039;Analysing&#039;&#039;&#039;, as much processing ressources on all CPUs as possible are used for data analysis. By using &#039;&#039;&#039;Capturing&#039;&#039;&#039;, the focus will be on high data throughput and low latency for capturing purposes by using only the CPU where the preferred newtork controller is attached to. This has an impact on data analysis performance. &#039;&#039;&#039;Analysing&#039;&#039;&#039; is used by default.&lt;br /&gt;
You should only change this parameter in discussion with the Allegro Packets support.&lt;br /&gt;
&lt;br /&gt;
=== Packet ring buffer timeouts ===&lt;br /&gt;
&lt;br /&gt;
Two timeout settings related to the packet ring buffer can be adjusted.&lt;br /&gt;
&lt;br /&gt;
* The long timeout controls after which maximum period of time a packet is actually written to the packet ring buffer. A lower value may decrease the time difference by which packets are stored out of their real order in the packet ring buffer but it may also increase the amount of unused overhead data in the packet ring buffer.&lt;br /&gt;
* The short timeout controls after which period of time smaller batches of packets are written to the packet ring buffer even if waiting for more packets would result in a more efficient operation. A lower value may decrease the time difference by which packets are stored out of their real order in the packet ring buffer but it may also decrease the performance of the packet ring buffer.&lt;br /&gt;
&lt;br /&gt;
=== Data retention timeout ===&lt;br /&gt;
&lt;br /&gt;
When this timeout is set to a value greater than 0, data will be removed from the system after the given number of minutes. This means that entities like IPs, which have been inactive for longer than the timeout, will be removed. History graph data for entities that are still active will be truncated to cover only the given timespan while the absolute values for the whole runtime will be retained. When a packet ring buffer is active, packets which are older than the timeout will be discarded.&lt;br /&gt;
&lt;br /&gt;
=== L3 tunnel mode ===&lt;br /&gt;
&lt;br /&gt;
If L3 tunnel mode is enabled for an interface this interface will only process packets encapsulated in GRE or GRE+ERSPAN and targeted for the configured IP address. All other packets received on that interface will be discarded. The system will process the packets as if only the inner encapsulated packet is seen and any traffic captures will only contain the encapsulated packet. An interface with L3 tunnel mode enabled will respond to ARP requests and to ICMP echo requests so it is possible to use ping to verify that the interface is reachable under the configured IP address. Currently only IPv4 L3 tunnels are supported. It must be noted that if the system is running in bridge packet processing mode any links with an interface configured for L3 tunnel mode will not forward traffic.&lt;br /&gt;
&lt;br /&gt;
=== Multithreaded capture analysis ===&lt;br /&gt;
&lt;br /&gt;
This option enables the use of multiple CPUs for capture analysis like when&lt;br /&gt;
analyzing a PCAP capture file or analyzing the packet ring buffer. Depending&lt;br /&gt;
on the number of available CPUs this can speed up the analysis significantly.&lt;br /&gt;
&lt;br /&gt;
It is possible to dedicate a number a CPUs exclusively to capture analysis.&lt;br /&gt;
Since these CPUs are not available for live packet processing the performance of&lt;br /&gt;
live traffic analysis may be lower.&lt;br /&gt;
When set to 0 a lower priority is used for capture analysis than for live analysis&lt;br /&gt;
but it cannot be ruled out that the performance of the live processing is&lt;br /&gt;
affected.&lt;br /&gt;
&lt;br /&gt;
=== Load balancing ===&lt;br /&gt;
&lt;br /&gt;
This option select the load distribution method. By default, network&lt;br /&gt;
traffic is balanced among all processing threads based on the IP&lt;br /&gt;
addresses. This is fast and usually the best way for good load&lt;br /&gt;
balancing.&lt;br /&gt;
&lt;br /&gt;
If the network traffic only happens between few IP addresses, this&lt;br /&gt;
method can lead to load imbalance so that some threads doing much more&lt;br /&gt;
work while other threads may idle. In this scenario the &amp;quot;flow based&lt;br /&gt;
balancing&amp;quot; can be enabled to distribute the traffic based on the IP&lt;br /&gt;
and port information. This will lead to better utilization of all&lt;br /&gt;
processing threads.&lt;br /&gt;
&lt;br /&gt;
Since this option induces additional processing overhead per packet&lt;br /&gt;
and additional memory for all internal IP statistics, it should only&lt;br /&gt;
be enabled in cases of significant load imbalance.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Global_settings&amp;diff=2842</id>
		<title>Global settings</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Global_settings&amp;diff=2842"/>
		<updated>2020-05-22T15:09:55Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* Graph detail settings */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;The Global settings section contains parameters for adjusting the behavior of the system.&lt;br /&gt;
The settings are split among multiple tabs, described as follows.&lt;br /&gt;
&lt;br /&gt;
== Generic settings ==&lt;br /&gt;
&lt;br /&gt;
=== Packet processing mode ===&lt;br /&gt;
&lt;br /&gt;
This section allows for configuring the main packet processing mode:&lt;br /&gt;
&lt;br /&gt;
* Bridge mode: In Bridge mode, all received packets will be retransmitted on the corresponding mutual port so that the device can be placed inline between any network component. The device will be transparent and will not modify the traffic in any way. The additional latency will be typically around or less than 1 millisecond.&lt;br /&gt;
* Sink mode: In Sink mode, packets are only received and not forwarded. This operation mode allows for installation at a Mirror port of a Switch or when using a network Tap to access the network traffic.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The packet processing mode can be changed during runtime.&lt;br /&gt;
&lt;br /&gt;
=== Webshark support ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter allows having a preview of the first Megabyte of packets directly in the browser, called Webshark. To support this, the device needs a small amount of system memory for packet processing. This amount of memory (~100MB) will be reserved by the Multimeter and is not available for the In-Memory database used to store metadata, thus the history of stored metadata is a little shorter. If this is not desired, it is possible to disable the Webshark support. Changing this value requires a restart of the processing.&lt;br /&gt;
&lt;br /&gt;
=== Limit module processing ===&lt;br /&gt;
&lt;br /&gt;
This setting allows you to configure which modules are active. With this setting, the performance of the Allegro Network Multimeter can be significantly improved and allows a higher throughput if you do not need to select some analysis modules.&lt;br /&gt;
&lt;br /&gt;
The following modes are possible:&lt;br /&gt;
&lt;br /&gt;
* Only capturing: Only interface statistics and the capture module is provided. The capture filters are supported except Layer 7 protocol recognition.&lt;br /&gt;
* Up to Layer 2: Additionally all Layer 2 related modules are active such as MAC, MAC protocols, ARP and Burst Analysis.&lt;br /&gt;
* Up to Layer 3: Additionally all Layer 3 related modules are active such as IP and DHCP statistics.&lt;br /&gt;
* Up to Layer 4: Additionally all Layer 4 related modules are active such as TCP and Layer 4 server ports.&lt;br /&gt;
* Unlimited: All modules are active.&lt;br /&gt;
&lt;br /&gt;
When switching to another mode you need to restart the processing in order to activate the new settings.&lt;br /&gt;
&lt;br /&gt;
=== Graph detail settings ===&lt;br /&gt;
&lt;br /&gt;
It is possible to modify the detail level of all graphs in the interface. This settings allow you to see a more detailed view (with higher time resolution) or to reduce the detail level so more data can be stored on the device. Changing the default values has an impact on the performance and memory usage. Changing a slider to the left increases the detail level of graphs, but increases memory usage and decreases performance.&lt;br /&gt;
&lt;br /&gt;
* Best graph resolution: This option configures how detailed the graph information are shown in the best case (the latest information). The default value is one second which means that a graph sample point represents a second of packet time. You can change the resolution up to 1 millisecond which gives a detailed sub-second representation of the traffic. You can also decide to decrease the resolution which enables the Multimeter to store more data for a longer period of time.&lt;br /&gt;
&lt;br /&gt;
* Reduce graph resolution of old data by up to: The resolution of older graph data is automatically reduced to save memory and to allow a longer view into the traffic history. This option allows you to change this behaviour. With a reduction factor of 1/1 no reduction is done at all which means the selected graph resolution is available for the complete time. &lt;br /&gt;
:This reduces the time period to see historical data. You can choose to increase the reduction factor to store more data for a longer period. The time printed in parentheses represents the worst-case graph resolution based on the chosen resolution and reduction factor.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Note: Regardless of these settings, the graph values are always converted to represent a value per second (when applicable). For example, the packets per second for IP addresses will always be a value literally per second even if the resolution is larger or smaller than one second. The displayed value is scaled to match this view. Especially with sub-second resolution this might be misleading. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
For instance, if there is a network element sending one packet per second and the resolution is set to 100 milliseconds, the value might be shown as 10 packets per second as each sample point is scaled to represent an value per second. For a detailed investigation it is recommended to select a specific time interval since the total packet counters shown in all statistics are unscaled and represent the actual values.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Performance implications: The performance degradation and memory usage depends on the actual network traffic and is not exactly predictable. &lt;br /&gt;
&lt;br /&gt;
Here are some examples for reference on a Multimeter 1000 series with different configuration values (under ideal test conditions):&lt;br /&gt;
&lt;br /&gt;
* 1 second resolution, 1/1 reduction factor: 90% of default performance&lt;br /&gt;
* 100 millisecond resolution, 1/1 reduction factor: 50% of default performance,&lt;br /&gt;
* 10 millisecond resolution, 1/1 reduction factor: 15% of default performance&lt;br /&gt;
* 1 millisecond resolution, 1/1 reduction factor: 10% of default performance&lt;br /&gt;
&lt;br /&gt;
=== pcap parallel analysis ===&lt;br /&gt;
&lt;br /&gt;
The pcap parallel analysis feature allows to analyse pcap files or the&lt;br /&gt;
packet ring buffer in parallel to the live measurement. The settings&lt;br /&gt;
allow to enable the feature and choose how much memory of the main&lt;br /&gt;
memory is used for parallel analysis and how many parallel slots can&lt;br /&gt;
be used. Detailed description of the configuration values are&lt;br /&gt;
described [[pcap parallel analysis|here]].&lt;br /&gt;
&lt;br /&gt;
== IPFIX settings ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter may be running as an IPFIX exporter. These settings allows configuration of reporting. When enabled, following settings are possible:&lt;br /&gt;
&lt;br /&gt;
* IP address: Address of IPFIX collector&lt;br /&gt;
* Port: Corresponding port&lt;br /&gt;
* Protocol: TCP or UDP&lt;br /&gt;
* Update interval: Interval in seconds for sending a status update of flows&lt;br /&gt;
* UDP resend interval: Interval in seconds for resending IPFIX templates for UDP connections&lt;br /&gt;
* TCP reconnect timeout: When TCP connection could not be established, wait for this time period until next try to establish a connection.&lt;br /&gt;
&lt;br /&gt;
Individual IPFIX messages can be enabled or disabled by toggling corresponding options. See the NetFlow/IPFIX interface documentation for details about the message types.&lt;br /&gt;
&lt;br /&gt;
== Time settings ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can be configured to use a time synchronization service. NTP is supported for all variants of the Multimeter, PTP service may be used if management interface supports hardware time stamping.&lt;br /&gt;
In case a GPS capable PTP grandmaster card is available, GPS time synchronization is available and the antenna cable delay in nanoseconds can be configured.&lt;br /&gt;
&lt;br /&gt;
To enable a time service, switch to the proper type in the dropdown box.&lt;br /&gt;
The time service field will show whether the selected service is running or not.&lt;br /&gt;
For NTP time retrieval you can specify and edit dedicated NTP servers. If you do not specify a NTP server, a set of predefined NTP servers will be taken automatically.&lt;br /&gt;
For PTP time retrieval, the PTP grandmaster clock identity is shown. This is usually an EUI-64 address. The first and last set of octets of the identity represent the (EUI-48) MAC address of the grandmaster.&lt;br /&gt;
&lt;br /&gt;
Following settings are possible for PTP and should match to the settings of the PTP grandmaster:&lt;br /&gt;
&lt;br /&gt;
* Delay mechanism: Use end-to-end (E2E), peer-to-peer (P2P) or automatic delay measurement. In case automatic measurement is selected, E2E is used at the beginning and switched to P2P when a peer delay request is received. Default is &#039;&#039;&#039;Auto&#039;&#039;&#039;.&lt;br /&gt;
* Network transport: Use UDPv4, UDPv6 or Layer 2 as network transport. Default is &#039;&#039;&#039;UDPv4&#039;&#039;&#039;.&lt;br /&gt;
* Domain number: The domain number of the grandmaster. This is used to define logical groups of synchronized clocks.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The GPS time retrieval option is available if a GPS capable PTP grandmaster card is installed in the Multimeter. &lt;br /&gt;
If no time synchronization mechanism is selected the date and time of the device can be configured manually by entering a properly formatted date and time description.&lt;br /&gt;
Below the time synchronization settings the time zone used by the device can be configured. The drop-down list provides a list of cities grouped by world regions to select the appropriate time zone from.&lt;br /&gt;
To make changes take effect, click on the Save settings button on the bottom of the page. To reload the stored settings, click on Reload settings.&lt;br /&gt;
&lt;br /&gt;
== Email notification ==&lt;br /&gt;
&lt;br /&gt;
Certain modules support the sending of email notifications. The following settings are used to globally configure the used SMTP server and the target email address that will receive the notifications:&lt;br /&gt;
&lt;br /&gt;
* Enable email notifications: globally enables or disables the sending of email notifications.&lt;br /&gt;
* SMTP server address: the address of the SMTP server that will be used to send out notification emails.&lt;br /&gt;
* SMTP server port: the TCP port on which the SMTP server is listening.&lt;br /&gt;
* SMTP server uses SSL: must be set to On if the SMTP server expects an SSL connection from the very start. If the SMTP server uses no SSL or STARTTLS this setting must be set to Off.&lt;br /&gt;
* Ignore certificate errors: if the SSL certificate should not be validated because e.g. it is a self-signed certificate this setting can be used to turn off certificate validation.&lt;br /&gt;
* Allow unencrypted connections: if an unencrypted connection must be allowed because e.g. a legacy SMTP server does not support it this setting can be used.&lt;br /&gt;
* Username: the username used to log in to the SMTP server.&lt;br /&gt;
* Password: the password used to log in to the SMTP server.&lt;br /&gt;
* From email address: the email address from which incident notifications will be sent.&lt;br /&gt;
* Target email address: the email address to which incident notifications will be sent.&lt;br /&gt;
* Email links base URL: this base URL will be used to generate the HTML links in notification emails. Since the device cannot by itself determine the proper address by which it is visible to the email recipient this setting can be used to set the right URL prefix for links sent with the notification emails.&lt;br /&gt;
* Send periodic system status mail: if set to hourly or daily a system status email will be sent to the configured target address with the selected frequency. It will contain basic system information and system health status, management interface configuration and a list of detected LLDP neighbors if the management LLDP feature is enabled.&lt;br /&gt;
&lt;br /&gt;
The Send test email button can be used to verify that the entered settings are working.&lt;br /&gt;
&lt;br /&gt;
== Expert settings ==&lt;br /&gt;
&lt;br /&gt;
The Expert settings contains parameter which are often only necessary to change in rare installation scenarios or some specific need for a different operation mode.&lt;br /&gt;
&lt;br /&gt;
=== Packet length accounting ===&lt;br /&gt;
&lt;br /&gt;
This setting allows to configure which packet length is used for all traffic counters and incidents. Following modes are possible:&lt;br /&gt;
&lt;br /&gt;
* Layer 1: Packet length is accounted on layer 1 including preamble (7 Byte), SFD (1 Byte) and inter frame gap (12 Byte)&lt;br /&gt;
* Layer 2 without frame check sequence (default): Packet length is accounted on layer 2 without frame check sequence (4 Byte)&lt;br /&gt;
* Layer 2 with frame check sequence: Account packet length on layer 2 with frame check sequence (4 Byte) When switching to another mode, it will only be applied on new packets. Older packet size statistics will not be changed.&lt;br /&gt;
&lt;br /&gt;
=== VLAN handling ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can ignore VLAN tags for connection tracking. Enabling this option might be necessary if network traffic is seen on the Network Multimeter that contains changing VLAN tags for the same connection. For example, depending on the configuration of the mirror port to which the Network Multimeter is connected, incoming traffic could contain a VLAN tag while outgoing traffic does not. In this example, a connection would appear two times in the statistics which is often the desired behavior to be able to identify a network misconfiguration. But sometimes this behavior is intended and the user want to see only one connection. In this scenario the option can be enabled to ignore varying VLAN tags for a otherwise identical connection.&lt;br /&gt;
&lt;br /&gt;
=== Tunnel view mode ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can decapsulate ERSPAN type II and type III traffic. In this mode all non-ERSPAN traffic is being discarded. On the dashboard a dropped counter will display dropped non ERSPAN packets for indication if this mode is active. The Multimeter will show the encapsulated content in all analysis modules. When capturing, packets with complete outer layer 2, layer 3, GRE and ERSPAN headers will be stored as seen on the wire.&lt;br /&gt;
&lt;br /&gt;
=== Database mode settings ===&lt;br /&gt;
&lt;br /&gt;
The database mode is a special analysis mode for high-performance Network Multimeters with multiple processors to increase the performance on such systems. It is normally enabled automatically but depending on the actual network traffic and system usage, some parameter tweak might be necessary to improve overall system performance. &lt;br /&gt;
You should only change these parameters in discussion with the Allegro Packets support.&lt;br /&gt;
These settings are only visible if your Network Multimeter is capable of running this mode.&lt;br /&gt;
&lt;br /&gt;
You can read more about the meaning of the settings [[DB mode|here]].&lt;br /&gt;
&lt;br /&gt;
=== Network performance ===&lt;br /&gt;
&lt;br /&gt;
There are several network performance settings available to improve performance on high-performance systems in case of packet drops during very high receive bandwidth. They are only visible if your Network Multimeter is capable of changing these settings.&lt;br /&gt;
&lt;br /&gt;
* Max RX queues per socket: This setting specifies the amount of threads dedicated to read and write interactions with the network interface controllers. By increasing this value, network receive bandwidth can be increased before packet drops occur. By decreasing this value, data analysis will improve. The default setting of 2 RX queues is suitable for most configurations as data analysis typically needs much more processing ressources.&lt;br /&gt;
* Use Hyper-Threading for RX queues: This setting allows enabling or disabling Hyper-Threading for the threads dedicated to read and write interactions with the network interface controllers. By disabling it, network performance can be improved as the RX queues will be distributed to physical CPU cores only. By enabling it, RX queues will also be distributed to virtual Hyper-Threading CPU cores which is not as efficient as physical CPU cores. By using Hyper-Threading, data analysis will improve as there are more CPU cores available for these tasks. Hyper-Threading is used by default. This is suitable for most configurations as data analysis typically needs much more processing ressources.&lt;br /&gt;
* Preferred Network interface controller: This setting allows fine tuning of network and data analysis performance for dedicated network controllers. The selected set of network controllers will be preferred over the others. Usually the fastest or the network controller with the most traffic should be preferred. The &#039;&#039;&#039;Auto&#039;&#039;&#039; setting is used by default, preferring the fastest network controller.&lt;br /&gt;
&lt;br /&gt;
You should only change these parameters in discussion with the Allegro Packets support.&lt;br /&gt;
&lt;br /&gt;
=== Processing performance ===&lt;br /&gt;
&lt;br /&gt;
The processing performance may be modified on high-performance systems. This is only visible if your Network Multimeter is capable of changing this setting.&lt;br /&gt;
&lt;br /&gt;
* Processing performance mode: This setting allows for fine tuning processing performance. By using &#039;&#039;&#039;Analysing&#039;&#039;&#039;, as much processing ressources on all CPUs as possible are used for data analysis. By using &#039;&#039;&#039;Capturing&#039;&#039;&#039;, the focus will be on high data throughput and low latency for capturing purposes by using only the CPU where the preferred newtork controller is attached to. This has an impact on data analysis performance. &#039;&#039;&#039;Analysing&#039;&#039;&#039; is used by default.&lt;br /&gt;
You should only change this parameter in discussion with the Allegro Packets support.&lt;br /&gt;
&lt;br /&gt;
=== Packet ring buffer timeouts ===&lt;br /&gt;
&lt;br /&gt;
Two timeout settings related to the packet ring buffer can be adjusted.&lt;br /&gt;
&lt;br /&gt;
* The long timeout controls after which maximum period of time a packet is actually written to the packet ring buffer. A lower value may decrease the time difference by which packets are stored out of their real order in the packet ring buffer but it may also increase the amount of unused overhead data in the packet ring buffer.&lt;br /&gt;
* The short timeout controls after which period of time smaller batches of packets are written to the packet ring buffer even if waiting for more packets would result in a more efficient operation. A lower value may decrease the time difference by which packets are stored out of their real order in the packet ring buffer but it may also decrease the performance of the packet ring buffer.&lt;br /&gt;
&lt;br /&gt;
=== Data retention timeout ===&lt;br /&gt;
&lt;br /&gt;
When this timeout is set to a value greater than 0, data will be removed from the system after the given number of minutes. This means that entities like IPs, which have been inactive for longer than the timeout, will be removed. History graph data for entities that are still active will be truncated to cover only the given timespan while the absolute values for the whole runtime will be retained. When a packet ring buffer is active, packets which are older than the timeout will be discarded.&lt;br /&gt;
&lt;br /&gt;
=== L3 tunnel mode ===&lt;br /&gt;
&lt;br /&gt;
If L3 tunnel mode is enabled for an interface this interface will only process packets encapsulated in GRE or GRE+ERSPAN and targeted for the configured IP address. All other packets received on that interface will be discarded. The system will process the packets as if only the inner encapsulated packet is seen and any traffic captures will only contain the encapsulated packet. An interface with L3 tunnel mode enabled will respond to ARP requests and to ICMP echo requests so it is possible to use ping to verify that the interface is reachable under the configured IP address. Currently only IPv4 L3 tunnels are supported. It must be noted that if the system is running in bridge packet processing mode any links with an interface configured for L3 tunnel mode will not forward traffic.&lt;br /&gt;
&lt;br /&gt;
=== Multithreaded capture analysis ===&lt;br /&gt;
&lt;br /&gt;
This option enables the use of multiple CPUs for capture analysis like when&lt;br /&gt;
analyzing a PCAP capture file or analyzing the packet ring buffer. Depending&lt;br /&gt;
on the number of available CPUs this can speed up the analysis significantly.&lt;br /&gt;
&lt;br /&gt;
It is possible to dedicate a number a CPUs exclusively to capture analysis.&lt;br /&gt;
Since these CPUs are not available for live packet processing the performance of&lt;br /&gt;
live traffic analysis may be lower.&lt;br /&gt;
When set to 0 a lower priority is used for capture analysis than for live analysis&lt;br /&gt;
but it cannot be ruled out that the performance of the live processing is&lt;br /&gt;
affected.&lt;br /&gt;
&lt;br /&gt;
=== Load balancing ===&lt;br /&gt;
&lt;br /&gt;
This option select the load distribution method. By default, network&lt;br /&gt;
traffic is balanced among all processing threads based on the IP&lt;br /&gt;
addresses. This is fast and usually the best way for good load&lt;br /&gt;
balancing.&lt;br /&gt;
&lt;br /&gt;
If the network traffic only happens between few IP addresses, this&lt;br /&gt;
method can lead to load imbalance so that some threads doing much more&lt;br /&gt;
work while other threads may idle. In this scenario the &amp;quot;flow based&lt;br /&gt;
balancing&amp;quot; can be enabled to distribute the traffic based on the IP&lt;br /&gt;
and port information. This will lead to better utilization of all&lt;br /&gt;
processing threads.&lt;br /&gt;
&lt;br /&gt;
Since this option induces additional processing overhead per packet&lt;br /&gt;
and additional memory for all internal IP statistics, it should only&lt;br /&gt;
be enabled in cases of significant load imbalance.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Global_settings&amp;diff=2841</id>
		<title>Global settings</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Global_settings&amp;diff=2841"/>
		<updated>2020-05-22T15:05:42Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* Limit module processing */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;The Global settings section contains parameters for adjusting the behavior of the system.&lt;br /&gt;
The settings are split among multiple tabs, described as follows.&lt;br /&gt;
&lt;br /&gt;
== Generic settings ==&lt;br /&gt;
&lt;br /&gt;
=== Packet processing mode ===&lt;br /&gt;
&lt;br /&gt;
This section allows for configuring the main packet processing mode:&lt;br /&gt;
&lt;br /&gt;
* Bridge mode: In Bridge mode, all received packets will be retransmitted on the corresponding mutual port so that the device can be placed inline between any network component. The device will be transparent and will not modify the traffic in any way. The additional latency will be typically around or less than 1 millisecond.&lt;br /&gt;
* Sink mode: In Sink mode, packets are only received and not forwarded. This operation mode allows for installation at a Mirror port of a Switch or when using a network Tap to access the network traffic.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The packet processing mode can be changed during runtime.&lt;br /&gt;
&lt;br /&gt;
=== Webshark support ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter allows having a preview of the first Megabyte of packets directly in the browser, called Webshark. To support this, the device needs a small amount of system memory for packet processing. This amount of memory (~100MB) will be reserved by the Multimeter and is not available for the In-Memory database used to store metadata, thus the history of stored metadata is a little shorter. If this is not desired, it is possible to disable the Webshark support. Changing this value requires a restart of the processing.&lt;br /&gt;
&lt;br /&gt;
=== Limit module processing ===&lt;br /&gt;
&lt;br /&gt;
This setting allows you to configure which modules are active. With this setting, the performance of the Allegro Network Multimeter can be significantly improved and allows a higher throughput if you do not need to select some analysis modules.&lt;br /&gt;
&lt;br /&gt;
The following modes are possible:&lt;br /&gt;
&lt;br /&gt;
* Only capturing: Only interface statistics and the capture module is provided. The capture filters are supported except Layer 7 protocol recognition.&lt;br /&gt;
* Up to Layer 2: Additionally all Layer 2 related modules are active such as MAC, MAC protocols, ARP and Burst Analysis.&lt;br /&gt;
* Up to Layer 3: Additionally all Layer 3 related modules are active such as IP and DHCP statistics.&lt;br /&gt;
* Up to Layer 4: Additionally all Layer 4 related modules are active such as TCP and Layer 4 server ports.&lt;br /&gt;
* Unlimited: All modules are active.&lt;br /&gt;
&lt;br /&gt;
When switching to another mode you need to restart the processing in order to activate the new settings.&lt;br /&gt;
&lt;br /&gt;
=== Graph detail settings ===&lt;br /&gt;
&lt;br /&gt;
It is possible to modify the detail level of all graphs in the interface. This settings allow to get a more detailed view (with higher time resolution) or to reduce the detail level so that more data can be stored on the device. Changing the default values have an impact on the performance and memory usage. Changing a slider to the left increases detail level of graphs, but also increases the memory usage and decreases the performance.&lt;br /&gt;
&lt;br /&gt;
* Best graph resolution: This option configures how detailed the graph information are shown in the best case (the latest information). The default value is one second which means that a graph sample point represents a second of packet time. You can change the resolution up to 1 millisecond which gives a detailed sub-second representation of the traffic. You can also decide to decrease the resolution which enables the Multimeter to store more data for a longer period of time.&lt;br /&gt;
&lt;br /&gt;
* Reduce graph resolution of old data by up to: The resolution of older graph data is automatically reduced to save memory and to allow a longer view into the traffic history. This option allows to change this behavior. With a reduction factor of 1/1 no reduction is done at all which means the selected graph resolution is available for the complete time. &lt;br /&gt;
:This of course reduces the time period to see historical data. You can also choose to increase the reduction factor to be able to store more data for a longer time. The time printed in parentheses represents the worst-case graph resolution based on the chosen resolution and reduction factor.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Note: Regardless of these settings, the graph values are always converted to represent a value per second (when applicable). For example, the packets per second for IP addresses will always be a value literally per second even if the resolution is larger or smaller than one second. The shown value is scaled to match this view. Especially with sub-second resolution this might be misleading. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
For instance, if there is a network element sending one packet per second and the resolution is set to 100 millisecond, the value might be shown as 10 packets per second as each sample point is scaled to represent an value per second. For a detailed investigation it is recommended to select a specific time interval since the total packet counters shown in all statistics are unscaled and represent the actual values.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Performance implications: The performance degradation and memory usage depends on the actual network traffic and is not exactly predictable. &lt;br /&gt;
&lt;br /&gt;
Here are some examples for reference on a Multimeter 1000 series with different configuration values (under ideal test conditions):&lt;br /&gt;
&lt;br /&gt;
* 1 second resolution, 1/1 reduction factor: 90% of default performance&lt;br /&gt;
* 100 millisecond resolution, 1/1 reduction factor: 50% of default performance,&lt;br /&gt;
* 10 millisecond resolution, 1/1 reduction factor: 15% of default performance&lt;br /&gt;
* 1 millisecond resolution, 1/1 reduction factor: 10% of default performance&lt;br /&gt;
&lt;br /&gt;
=== pcap parallel analysis ===&lt;br /&gt;
&lt;br /&gt;
The pcap parallel analysis feature allows to analyse pcap files or the&lt;br /&gt;
packet ring buffer in parallel to the live measurement. The settings&lt;br /&gt;
allow to enable the feature and choose how much memory of the main&lt;br /&gt;
memory is used for parallel analysis and how many parallel slots can&lt;br /&gt;
be used. Detailed description of the configuration values are&lt;br /&gt;
described [[pcap parallel analysis|here]].&lt;br /&gt;
&lt;br /&gt;
== IPFIX settings ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter may be running as an IPFIX exporter. These settings allows configuration of reporting. When enabled, following settings are possible:&lt;br /&gt;
&lt;br /&gt;
* IP address: Address of IPFIX collector&lt;br /&gt;
* Port: Corresponding port&lt;br /&gt;
* Protocol: TCP or UDP&lt;br /&gt;
* Update interval: Interval in seconds for sending a status update of flows&lt;br /&gt;
* UDP resend interval: Interval in seconds for resending IPFIX templates for UDP connections&lt;br /&gt;
* TCP reconnect timeout: When TCP connection could not be established, wait for this time period until next try to establish a connection.&lt;br /&gt;
&lt;br /&gt;
Individual IPFIX messages can be enabled or disabled by toggling corresponding options. See the NetFlow/IPFIX interface documentation for details about the message types.&lt;br /&gt;
&lt;br /&gt;
== Time settings ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can be configured to use a time synchronization service. NTP is supported for all variants of the Multimeter, PTP service may be used if management interface supports hardware time stamping.&lt;br /&gt;
In case a GPS capable PTP grandmaster card is available, GPS time synchronization is available and the antenna cable delay in nanoseconds can be configured.&lt;br /&gt;
&lt;br /&gt;
To enable a time service, switch to the proper type in the dropdown box.&lt;br /&gt;
The time service field will show whether the selected service is running or not.&lt;br /&gt;
For NTP time retrieval you can specify and edit dedicated NTP servers. If you do not specify a NTP server, a set of predefined NTP servers will be taken automatically.&lt;br /&gt;
For PTP time retrieval, the PTP grandmaster clock identity is shown. This is usually an EUI-64 address. The first and last set of octets of the identity represent the (EUI-48) MAC address of the grandmaster.&lt;br /&gt;
&lt;br /&gt;
Following settings are possible for PTP and should match to the settings of the PTP grandmaster:&lt;br /&gt;
&lt;br /&gt;
* Delay mechanism: Use end-to-end (E2E), peer-to-peer (P2P) or automatic delay measurement. In case automatic measurement is selected, E2E is used at the beginning and switched to P2P when a peer delay request is received. Default is &#039;&#039;&#039;Auto&#039;&#039;&#039;.&lt;br /&gt;
* Network transport: Use UDPv4, UDPv6 or Layer 2 as network transport. Default is &#039;&#039;&#039;UDPv4&#039;&#039;&#039;.&lt;br /&gt;
* Domain number: The domain number of the grandmaster. This is used to define logical groups of synchronized clocks.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The GPS time retrieval option is available if a GPS capable PTP grandmaster card is installed in the Multimeter. &lt;br /&gt;
If no time synchronization mechanism is selected the date and time of the device can be configured manually by entering a properly formatted date and time description.&lt;br /&gt;
Below the time synchronization settings the time zone used by the device can be configured. The drop-down list provides a list of cities grouped by world regions to select the appropriate time zone from.&lt;br /&gt;
To make changes take effect, click on the Save settings button on the bottom of the page. To reload the stored settings, click on Reload settings.&lt;br /&gt;
&lt;br /&gt;
== Email notification ==&lt;br /&gt;
&lt;br /&gt;
Certain modules support the sending of email notifications. The following settings are used to globally configure the used SMTP server and the target email address that will receive the notifications:&lt;br /&gt;
&lt;br /&gt;
* Enable email notifications: globally enables or disables the sending of email notifications.&lt;br /&gt;
* SMTP server address: the address of the SMTP server that will be used to send out notification emails.&lt;br /&gt;
* SMTP server port: the TCP port on which the SMTP server is listening.&lt;br /&gt;
* SMTP server uses SSL: must be set to On if the SMTP server expects an SSL connection from the very start. If the SMTP server uses no SSL or STARTTLS this setting must be set to Off.&lt;br /&gt;
* Ignore certificate errors: if the SSL certificate should not be validated because e.g. it is a self-signed certificate this setting can be used to turn off certificate validation.&lt;br /&gt;
* Allow unencrypted connections: if an unencrypted connection must be allowed because e.g. a legacy SMTP server does not support it this setting can be used.&lt;br /&gt;
* Username: the username used to log in to the SMTP server.&lt;br /&gt;
* Password: the password used to log in to the SMTP server.&lt;br /&gt;
* From email address: the email address from which incident notifications will be sent.&lt;br /&gt;
* Target email address: the email address to which incident notifications will be sent.&lt;br /&gt;
* Email links base URL: this base URL will be used to generate the HTML links in notification emails. Since the device cannot by itself determine the proper address by which it is visible to the email recipient this setting can be used to set the right URL prefix for links sent with the notification emails.&lt;br /&gt;
* Send periodic system status mail: if set to hourly or daily a system status email will be sent to the configured target address with the selected frequency. It will contain basic system information and system health status, management interface configuration and a list of detected LLDP neighbors if the management LLDP feature is enabled.&lt;br /&gt;
&lt;br /&gt;
The Send test email button can be used to verify that the entered settings are working.&lt;br /&gt;
&lt;br /&gt;
== Expert settings ==&lt;br /&gt;
&lt;br /&gt;
The Expert settings contains parameter which are often only necessary to change in rare installation scenarios or some specific need for a different operation mode.&lt;br /&gt;
&lt;br /&gt;
=== Packet length accounting ===&lt;br /&gt;
&lt;br /&gt;
This setting allows to configure which packet length is used for all traffic counters and incidents. Following modes are possible:&lt;br /&gt;
&lt;br /&gt;
* Layer 1: Packet length is accounted on layer 1 including preamble (7 Byte), SFD (1 Byte) and inter frame gap (12 Byte)&lt;br /&gt;
* Layer 2 without frame check sequence (default): Packet length is accounted on layer 2 without frame check sequence (4 Byte)&lt;br /&gt;
* Layer 2 with frame check sequence: Account packet length on layer 2 with frame check sequence (4 Byte) When switching to another mode, it will only be applied on new packets. Older packet size statistics will not be changed.&lt;br /&gt;
&lt;br /&gt;
=== VLAN handling ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can ignore VLAN tags for connection tracking. Enabling this option might be necessary if network traffic is seen on the Network Multimeter that contains changing VLAN tags for the same connection. For example, depending on the configuration of the mirror port to which the Network Multimeter is connected, incoming traffic could contain a VLAN tag while outgoing traffic does not. In this example, a connection would appear two times in the statistics which is often the desired behavior to be able to identify a network misconfiguration. But sometimes this behavior is intended and the user want to see only one connection. In this scenario the option can be enabled to ignore varying VLAN tags for a otherwise identical connection.&lt;br /&gt;
&lt;br /&gt;
=== Tunnel view mode ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can decapsulate ERSPAN type II and type III traffic. In this mode all non-ERSPAN traffic is being discarded. On the dashboard a dropped counter will display dropped non ERSPAN packets for indication if this mode is active. The Multimeter will show the encapsulated content in all analysis modules. When capturing, packets with complete outer layer 2, layer 3, GRE and ERSPAN headers will be stored as seen on the wire.&lt;br /&gt;
&lt;br /&gt;
=== Database mode settings ===&lt;br /&gt;
&lt;br /&gt;
The database mode is a special analysis mode for high-performance Network Multimeters with multiple processors to increase the performance on such systems. It is normally enabled automatically but depending on the actual network traffic and system usage, some parameter tweak might be necessary to improve overall system performance. &lt;br /&gt;
You should only change these parameters in discussion with the Allegro Packets support.&lt;br /&gt;
These settings are only visible if your Network Multimeter is capable of running this mode.&lt;br /&gt;
&lt;br /&gt;
You can read more about the meaning of the settings [[DB mode|here]].&lt;br /&gt;
&lt;br /&gt;
=== Network performance ===&lt;br /&gt;
&lt;br /&gt;
There are several network performance settings available to improve performance on high-performance systems in case of packet drops during very high receive bandwidth. They are only visible if your Network Multimeter is capable of changing these settings.&lt;br /&gt;
&lt;br /&gt;
* Max RX queues per socket: This setting specifies the amount of threads dedicated to read and write interactions with the network interface controllers. By increasing this value, network receive bandwidth can be increased before packet drops occur. By decreasing this value, data analysis will improve. The default setting of 2 RX queues is suitable for most configurations as data analysis typically needs much more processing ressources.&lt;br /&gt;
* Use Hyper-Threading for RX queues: This setting allows enabling or disabling Hyper-Threading for the threads dedicated to read and write interactions with the network interface controllers. By disabling it, network performance can be improved as the RX queues will be distributed to physical CPU cores only. By enabling it, RX queues will also be distributed to virtual Hyper-Threading CPU cores which is not as efficient as physical CPU cores. By using Hyper-Threading, data analysis will improve as there are more CPU cores available for these tasks. Hyper-Threading is used by default. This is suitable for most configurations as data analysis typically needs much more processing ressources.&lt;br /&gt;
* Preferred Network interface controller: This setting allows fine tuning of network and data analysis performance for dedicated network controllers. The selected set of network controllers will be preferred over the others. Usually the fastest or the network controller with the most traffic should be preferred. The &#039;&#039;&#039;Auto&#039;&#039;&#039; setting is used by default, preferring the fastest network controller.&lt;br /&gt;
&lt;br /&gt;
You should only change these parameters in discussion with the Allegro Packets support.&lt;br /&gt;
&lt;br /&gt;
=== Processing performance ===&lt;br /&gt;
&lt;br /&gt;
The processing performance may be modified on high-performance systems. This is only visible if your Network Multimeter is capable of changing this setting.&lt;br /&gt;
&lt;br /&gt;
* Processing performance mode: This setting allows for fine tuning processing performance. By using &#039;&#039;&#039;Analysing&#039;&#039;&#039;, as much processing ressources on all CPUs as possible are used for data analysis. By using &#039;&#039;&#039;Capturing&#039;&#039;&#039;, the focus will be on high data throughput and low latency for capturing purposes by using only the CPU where the preferred newtork controller is attached to. This has an impact on data analysis performance. &#039;&#039;&#039;Analysing&#039;&#039;&#039; is used by default.&lt;br /&gt;
You should only change this parameter in discussion with the Allegro Packets support.&lt;br /&gt;
&lt;br /&gt;
=== Packet ring buffer timeouts ===&lt;br /&gt;
&lt;br /&gt;
Two timeout settings related to the packet ring buffer can be adjusted.&lt;br /&gt;
&lt;br /&gt;
* The long timeout controls after which maximum period of time a packet is actually written to the packet ring buffer. A lower value may decrease the time difference by which packets are stored out of their real order in the packet ring buffer but it may also increase the amount of unused overhead data in the packet ring buffer.&lt;br /&gt;
* The short timeout controls after which period of time smaller batches of packets are written to the packet ring buffer even if waiting for more packets would result in a more efficient operation. A lower value may decrease the time difference by which packets are stored out of their real order in the packet ring buffer but it may also decrease the performance of the packet ring buffer.&lt;br /&gt;
&lt;br /&gt;
=== Data retention timeout ===&lt;br /&gt;
&lt;br /&gt;
When this timeout is set to a value greater than 0, data will be removed from the system after the given number of minutes. This means that entities like IPs, which have been inactive for longer than the timeout, will be removed. History graph data for entities that are still active will be truncated to cover only the given timespan while the absolute values for the whole runtime will be retained. When a packet ring buffer is active, packets which are older than the timeout will be discarded.&lt;br /&gt;
&lt;br /&gt;
=== L3 tunnel mode ===&lt;br /&gt;
&lt;br /&gt;
If L3 tunnel mode is enabled for an interface this interface will only process packets encapsulated in GRE or GRE+ERSPAN and targeted for the configured IP address. All other packets received on that interface will be discarded. The system will process the packets as if only the inner encapsulated packet is seen and any traffic captures will only contain the encapsulated packet. An interface with L3 tunnel mode enabled will respond to ARP requests and to ICMP echo requests so it is possible to use ping to verify that the interface is reachable under the configured IP address. Currently only IPv4 L3 tunnels are supported. It must be noted that if the system is running in bridge packet processing mode any links with an interface configured for L3 tunnel mode will not forward traffic.&lt;br /&gt;
&lt;br /&gt;
=== Multithreaded capture analysis ===&lt;br /&gt;
&lt;br /&gt;
This option enables the use of multiple CPUs for capture analysis like when&lt;br /&gt;
analyzing a PCAP capture file or analyzing the packet ring buffer. Depending&lt;br /&gt;
on the number of available CPUs this can speed up the analysis significantly.&lt;br /&gt;
&lt;br /&gt;
It is possible to dedicate a number a CPUs exclusively to capture analysis.&lt;br /&gt;
Since these CPUs are not available for live packet processing the performance of&lt;br /&gt;
live traffic analysis may be lower.&lt;br /&gt;
When set to 0 a lower priority is used for capture analysis than for live analysis&lt;br /&gt;
but it cannot be ruled out that the performance of the live processing is&lt;br /&gt;
affected.&lt;br /&gt;
&lt;br /&gt;
=== Load balancing ===&lt;br /&gt;
&lt;br /&gt;
This option select the load distribution method. By default, network&lt;br /&gt;
traffic is balanced among all processing threads based on the IP&lt;br /&gt;
addresses. This is fast and usually the best way for good load&lt;br /&gt;
balancing.&lt;br /&gt;
&lt;br /&gt;
If the network traffic only happens between few IP addresses, this&lt;br /&gt;
method can lead to load imbalance so that some threads doing much more&lt;br /&gt;
work while other threads may idle. In this scenario the &amp;quot;flow based&lt;br /&gt;
balancing&amp;quot; can be enabled to distribute the traffic based on the IP&lt;br /&gt;
and port information. This will lead to better utilization of all&lt;br /&gt;
processing threads.&lt;br /&gt;
&lt;br /&gt;
Since this option induces additional processing overhead per packet&lt;br /&gt;
and additional memory for all internal IP statistics, it should only&lt;br /&gt;
be enabled in cases of significant load imbalance.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Global_settings&amp;diff=2840</id>
		<title>Global settings</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Global_settings&amp;diff=2840"/>
		<updated>2020-05-22T15:02:57Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* Webshark support */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;The Global settings section contains parameters for adjusting the behavior of the system.&lt;br /&gt;
The settings are split among multiple tabs, described as follows.&lt;br /&gt;
&lt;br /&gt;
== Generic settings ==&lt;br /&gt;
&lt;br /&gt;
=== Packet processing mode ===&lt;br /&gt;
&lt;br /&gt;
This section allows for configuring the main packet processing mode:&lt;br /&gt;
&lt;br /&gt;
* Bridge mode: In Bridge mode, all received packets will be retransmitted on the corresponding mutual port so that the device can be placed inline between any network component. The device will be transparent and will not modify the traffic in any way. The additional latency will be typically around or less than 1 millisecond.&lt;br /&gt;
* Sink mode: In Sink mode, packets are only received and not forwarded. This operation mode allows for installation at a Mirror port of a Switch or when using a network Tap to access the network traffic.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The packet processing mode can be changed during runtime.&lt;br /&gt;
&lt;br /&gt;
=== Webshark support ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter allows having a preview of the first Megabyte of packets directly in the browser, called Webshark. To support this, the device needs a small amount of system memory for packet processing. This amount of memory (~100MB) will be reserved by the Multimeter and is not available for the In-Memory database used to store metadata, thus the history of stored metadata is a little shorter. If this is not desired, it is possible to disable the Webshark support. Changing this value requires a restart of the processing.&lt;br /&gt;
&lt;br /&gt;
=== Limit module processing ===&lt;br /&gt;
&lt;br /&gt;
This setting allows to configure which modules are active. With this setting, the performance of the Allegro Network Multimeter can be drastically improved and allows a higher throughput if you don’t need some analysis modules.&lt;br /&gt;
&lt;br /&gt;
Following modes are possible:&lt;br /&gt;
&lt;br /&gt;
* Only capturing: Only interface statistics and the capture module is provided. The capture filters are support except layer 7 protocol recognition.&lt;br /&gt;
* Up to layer 2: Additionally all layer 2 related modules are active such as MAC, MAC protocols, ARP and Burst Analysis.&lt;br /&gt;
* Up to layer 3: Additionally all layer 3 related modules are active such as IP and DHCP statistics.&lt;br /&gt;
* Up to layer 4: Additionally all layer 4 related modules are active such as TCP and Layer 4 server ports.&lt;br /&gt;
* Unlimited: All modules are active.&lt;br /&gt;
&lt;br /&gt;
When switching to another mode you have to restart the processing in order to activate the new settings.&lt;br /&gt;
&lt;br /&gt;
=== Graph detail settings ===&lt;br /&gt;
&lt;br /&gt;
It is possible to modify the detail level of all graphs in the interface. This settings allow to get a more detailed view (with higher time resolution) or to reduce the detail level so that more data can be stored on the device. Changing the default values have an impact on the performance and memory usage. Changing a slider to the left increases detail level of graphs, but also increases the memory usage and decreases the performance.&lt;br /&gt;
&lt;br /&gt;
* Best graph resolution: This option configures how detailed the graph information are shown in the best case (the latest information). The default value is one second which means that a graph sample point represents a second of packet time. You can change the resolution up to 1 millisecond which gives a detailed sub-second representation of the traffic. You can also decide to decrease the resolution which enables the Multimeter to store more data for a longer period of time.&lt;br /&gt;
&lt;br /&gt;
* Reduce graph resolution of old data by up to: The resolution of older graph data is automatically reduced to save memory and to allow a longer view into the traffic history. This option allows to change this behavior. With a reduction factor of 1/1 no reduction is done at all which means the selected graph resolution is available for the complete time. &lt;br /&gt;
:This of course reduces the time period to see historical data. You can also choose to increase the reduction factor to be able to store more data for a longer time. The time printed in parentheses represents the worst-case graph resolution based on the chosen resolution and reduction factor.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Note: Regardless of these settings, the graph values are always converted to represent a value per second (when applicable). For example, the packets per second for IP addresses will always be a value literally per second even if the resolution is larger or smaller than one second. The shown value is scaled to match this view. Especially with sub-second resolution this might be misleading. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
For instance, if there is a network element sending one packet per second and the resolution is set to 100 millisecond, the value might be shown as 10 packets per second as each sample point is scaled to represent an value per second. For a detailed investigation it is recommended to select a specific time interval since the total packet counters shown in all statistics are unscaled and represent the actual values.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Performance implications: The performance degradation and memory usage depends on the actual network traffic and is not exactly predictable. &lt;br /&gt;
&lt;br /&gt;
Here are some examples for reference on a Multimeter 1000 series with different configuration values (under ideal test conditions):&lt;br /&gt;
&lt;br /&gt;
* 1 second resolution, 1/1 reduction factor: 90% of default performance&lt;br /&gt;
* 100 millisecond resolution, 1/1 reduction factor: 50% of default performance,&lt;br /&gt;
* 10 millisecond resolution, 1/1 reduction factor: 15% of default performance&lt;br /&gt;
* 1 millisecond resolution, 1/1 reduction factor: 10% of default performance&lt;br /&gt;
&lt;br /&gt;
=== pcap parallel analysis ===&lt;br /&gt;
&lt;br /&gt;
The pcap parallel analysis feature allows to analyse pcap files or the&lt;br /&gt;
packet ring buffer in parallel to the live measurement. The settings&lt;br /&gt;
allow to enable the feature and choose how much memory of the main&lt;br /&gt;
memory is used for parallel analysis and how many parallel slots can&lt;br /&gt;
be used. Detailed description of the configuration values are&lt;br /&gt;
described [[pcap parallel analysis|here]].&lt;br /&gt;
&lt;br /&gt;
== IPFIX settings ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter may be running as an IPFIX exporter. These settings allows configuration of reporting. When enabled, following settings are possible:&lt;br /&gt;
&lt;br /&gt;
* IP address: Address of IPFIX collector&lt;br /&gt;
* Port: Corresponding port&lt;br /&gt;
* Protocol: TCP or UDP&lt;br /&gt;
* Update interval: Interval in seconds for sending a status update of flows&lt;br /&gt;
* UDP resend interval: Interval in seconds for resending IPFIX templates for UDP connections&lt;br /&gt;
* TCP reconnect timeout: When TCP connection could not be established, wait for this time period until next try to establish a connection.&lt;br /&gt;
&lt;br /&gt;
Individual IPFIX messages can be enabled or disabled by toggling corresponding options. See the NetFlow/IPFIX interface documentation for details about the message types.&lt;br /&gt;
&lt;br /&gt;
== Time settings ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can be configured to use a time synchronization service. NTP is supported for all variants of the Multimeter, PTP service may be used if management interface supports hardware time stamping.&lt;br /&gt;
In case a GPS capable PTP grandmaster card is available, GPS time synchronization is available and the antenna cable delay in nanoseconds can be configured.&lt;br /&gt;
&lt;br /&gt;
To enable a time service, switch to the proper type in the dropdown box.&lt;br /&gt;
The time service field will show whether the selected service is running or not.&lt;br /&gt;
For NTP time retrieval you can specify and edit dedicated NTP servers. If you do not specify a NTP server, a set of predefined NTP servers will be taken automatically.&lt;br /&gt;
For PTP time retrieval, the PTP grandmaster clock identity is shown. This is usually an EUI-64 address. The first and last set of octets of the identity represent the (EUI-48) MAC address of the grandmaster.&lt;br /&gt;
&lt;br /&gt;
Following settings are possible for PTP and should match to the settings of the PTP grandmaster:&lt;br /&gt;
&lt;br /&gt;
* Delay mechanism: Use end-to-end (E2E), peer-to-peer (P2P) or automatic delay measurement. In case automatic measurement is selected, E2E is used at the beginning and switched to P2P when a peer delay request is received. Default is &#039;&#039;&#039;Auto&#039;&#039;&#039;.&lt;br /&gt;
* Network transport: Use UDPv4, UDPv6 or Layer 2 as network transport. Default is &#039;&#039;&#039;UDPv4&#039;&#039;&#039;.&lt;br /&gt;
* Domain number: The domain number of the grandmaster. This is used to define logical groups of synchronized clocks.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The GPS time retrieval option is available if a GPS capable PTP grandmaster card is installed in the Multimeter. &lt;br /&gt;
If no time synchronization mechanism is selected the date and time of the device can be configured manually by entering a properly formatted date and time description.&lt;br /&gt;
Below the time synchronization settings the time zone used by the device can be configured. The drop-down list provides a list of cities grouped by world regions to select the appropriate time zone from.&lt;br /&gt;
To make changes take effect, click on the Save settings button on the bottom of the page. To reload the stored settings, click on Reload settings.&lt;br /&gt;
&lt;br /&gt;
== Email notification ==&lt;br /&gt;
&lt;br /&gt;
Certain modules support the sending of email notifications. The following settings are used to globally configure the used SMTP server and the target email address that will receive the notifications:&lt;br /&gt;
&lt;br /&gt;
* Enable email notifications: globally enables or disables the sending of email notifications.&lt;br /&gt;
* SMTP server address: the address of the SMTP server that will be used to send out notification emails.&lt;br /&gt;
* SMTP server port: the TCP port on which the SMTP server is listening.&lt;br /&gt;
* SMTP server uses SSL: must be set to On if the SMTP server expects an SSL connection from the very start. If the SMTP server uses no SSL or STARTTLS this setting must be set to Off.&lt;br /&gt;
* Ignore certificate errors: if the SSL certificate should not be validated because e.g. it is a self-signed certificate this setting can be used to turn off certificate validation.&lt;br /&gt;
* Allow unencrypted connections: if an unencrypted connection must be allowed because e.g. a legacy SMTP server does not support it this setting can be used.&lt;br /&gt;
* Username: the username used to log in to the SMTP server.&lt;br /&gt;
* Password: the password used to log in to the SMTP server.&lt;br /&gt;
* From email address: the email address from which incident notifications will be sent.&lt;br /&gt;
* Target email address: the email address to which incident notifications will be sent.&lt;br /&gt;
* Email links base URL: this base URL will be used to generate the HTML links in notification emails. Since the device cannot by itself determine the proper address by which it is visible to the email recipient this setting can be used to set the right URL prefix for links sent with the notification emails.&lt;br /&gt;
* Send periodic system status mail: if set to hourly or daily a system status email will be sent to the configured target address with the selected frequency. It will contain basic system information and system health status, management interface configuration and a list of detected LLDP neighbors if the management LLDP feature is enabled.&lt;br /&gt;
&lt;br /&gt;
The Send test email button can be used to verify that the entered settings are working.&lt;br /&gt;
&lt;br /&gt;
== Expert settings ==&lt;br /&gt;
&lt;br /&gt;
The Expert settings contains parameter which are often only necessary to change in rare installation scenarios or some specific need for a different operation mode.&lt;br /&gt;
&lt;br /&gt;
=== Packet length accounting ===&lt;br /&gt;
&lt;br /&gt;
This setting allows to configure which packet length is used for all traffic counters and incidents. Following modes are possible:&lt;br /&gt;
&lt;br /&gt;
* Layer 1: Packet length is accounted on layer 1 including preamble (7 Byte), SFD (1 Byte) and inter frame gap (12 Byte)&lt;br /&gt;
* Layer 2 without frame check sequence (default): Packet length is accounted on layer 2 without frame check sequence (4 Byte)&lt;br /&gt;
* Layer 2 with frame check sequence: Account packet length on layer 2 with frame check sequence (4 Byte) When switching to another mode, it will only be applied on new packets. Older packet size statistics will not be changed.&lt;br /&gt;
&lt;br /&gt;
=== VLAN handling ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can ignore VLAN tags for connection tracking. Enabling this option might be necessary if network traffic is seen on the Network Multimeter that contains changing VLAN tags for the same connection. For example, depending on the configuration of the mirror port to which the Network Multimeter is connected, incoming traffic could contain a VLAN tag while outgoing traffic does not. In this example, a connection would appear two times in the statistics which is often the desired behavior to be able to identify a network misconfiguration. But sometimes this behavior is intended and the user want to see only one connection. In this scenario the option can be enabled to ignore varying VLAN tags for a otherwise identical connection.&lt;br /&gt;
&lt;br /&gt;
=== Tunnel view mode ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can decapsulate ERSPAN type II and type III traffic. In this mode all non-ERSPAN traffic is being discarded. On the dashboard a dropped counter will display dropped non ERSPAN packets for indication if this mode is active. The Multimeter will show the encapsulated content in all analysis modules. When capturing, packets with complete outer layer 2, layer 3, GRE and ERSPAN headers will be stored as seen on the wire.&lt;br /&gt;
&lt;br /&gt;
=== Database mode settings ===&lt;br /&gt;
&lt;br /&gt;
The database mode is a special analysis mode for high-performance Network Multimeters with multiple processors to increase the performance on such systems. It is normally enabled automatically but depending on the actual network traffic and system usage, some parameter tweak might be necessary to improve overall system performance. &lt;br /&gt;
You should only change these parameters in discussion with the Allegro Packets support.&lt;br /&gt;
These settings are only visible if your Network Multimeter is capable of running this mode.&lt;br /&gt;
&lt;br /&gt;
You can read more about the meaning of the settings [[DB mode|here]].&lt;br /&gt;
&lt;br /&gt;
=== Network performance ===&lt;br /&gt;
&lt;br /&gt;
There are several network performance settings available to improve performance on high-performance systems in case of packet drops during very high receive bandwidth. They are only visible if your Network Multimeter is capable of changing these settings.&lt;br /&gt;
&lt;br /&gt;
* Max RX queues per socket: This setting specifies the amount of threads dedicated to read and write interactions with the network interface controllers. By increasing this value, network receive bandwidth can be increased before packet drops occur. By decreasing this value, data analysis will improve. The default setting of 2 RX queues is suitable for most configurations as data analysis typically needs much more processing ressources.&lt;br /&gt;
* Use Hyper-Threading for RX queues: This setting allows enabling or disabling Hyper-Threading for the threads dedicated to read and write interactions with the network interface controllers. By disabling it, network performance can be improved as the RX queues will be distributed to physical CPU cores only. By enabling it, RX queues will also be distributed to virtual Hyper-Threading CPU cores which is not as efficient as physical CPU cores. By using Hyper-Threading, data analysis will improve as there are more CPU cores available for these tasks. Hyper-Threading is used by default. This is suitable for most configurations as data analysis typically needs much more processing ressources.&lt;br /&gt;
* Preferred Network interface controller: This setting allows fine tuning of network and data analysis performance for dedicated network controllers. The selected set of network controllers will be preferred over the others. Usually the fastest or the network controller with the most traffic should be preferred. The &#039;&#039;&#039;Auto&#039;&#039;&#039; setting is used by default, preferring the fastest network controller.&lt;br /&gt;
&lt;br /&gt;
You should only change these parameters in discussion with the Allegro Packets support.&lt;br /&gt;
&lt;br /&gt;
=== Processing performance ===&lt;br /&gt;
&lt;br /&gt;
The processing performance may be modified on high-performance systems. This is only visible if your Network Multimeter is capable of changing this setting.&lt;br /&gt;
&lt;br /&gt;
* Processing performance mode: This setting allows for fine tuning processing performance. By using &#039;&#039;&#039;Analysing&#039;&#039;&#039;, as much processing ressources on all CPUs as possible are used for data analysis. By using &#039;&#039;&#039;Capturing&#039;&#039;&#039;, the focus will be on high data throughput and low latency for capturing purposes by using only the CPU where the preferred newtork controller is attached to. This has an impact on data analysis performance. &#039;&#039;&#039;Analysing&#039;&#039;&#039; is used by default.&lt;br /&gt;
You should only change this parameter in discussion with the Allegro Packets support.&lt;br /&gt;
&lt;br /&gt;
=== Packet ring buffer timeouts ===&lt;br /&gt;
&lt;br /&gt;
Two timeout settings related to the packet ring buffer can be adjusted.&lt;br /&gt;
&lt;br /&gt;
* The long timeout controls after which maximum period of time a packet is actually written to the packet ring buffer. A lower value may decrease the time difference by which packets are stored out of their real order in the packet ring buffer but it may also increase the amount of unused overhead data in the packet ring buffer.&lt;br /&gt;
* The short timeout controls after which period of time smaller batches of packets are written to the packet ring buffer even if waiting for more packets would result in a more efficient operation. A lower value may decrease the time difference by which packets are stored out of their real order in the packet ring buffer but it may also decrease the performance of the packet ring buffer.&lt;br /&gt;
&lt;br /&gt;
=== Data retention timeout ===&lt;br /&gt;
&lt;br /&gt;
When this timeout is set to a value greater than 0, data will be removed from the system after the given number of minutes. This means that entities like IPs, which have been inactive for longer than the timeout, will be removed. History graph data for entities that are still active will be truncated to cover only the given timespan while the absolute values for the whole runtime will be retained. When a packet ring buffer is active, packets which are older than the timeout will be discarded.&lt;br /&gt;
&lt;br /&gt;
=== L3 tunnel mode ===&lt;br /&gt;
&lt;br /&gt;
If L3 tunnel mode is enabled for an interface this interface will only process packets encapsulated in GRE or GRE+ERSPAN and targeted for the configured IP address. All other packets received on that interface will be discarded. The system will process the packets as if only the inner encapsulated packet is seen and any traffic captures will only contain the encapsulated packet. An interface with L3 tunnel mode enabled will respond to ARP requests and to ICMP echo requests so it is possible to use ping to verify that the interface is reachable under the configured IP address. Currently only IPv4 L3 tunnels are supported. It must be noted that if the system is running in bridge packet processing mode any links with an interface configured for L3 tunnel mode will not forward traffic.&lt;br /&gt;
&lt;br /&gt;
=== Multithreaded capture analysis ===&lt;br /&gt;
&lt;br /&gt;
This option enables the use of multiple CPUs for capture analysis like when&lt;br /&gt;
analyzing a PCAP capture file or analyzing the packet ring buffer. Depending&lt;br /&gt;
on the number of available CPUs this can speed up the analysis significantly.&lt;br /&gt;
&lt;br /&gt;
It is possible to dedicate a number a CPUs exclusively to capture analysis.&lt;br /&gt;
Since these CPUs are not available for live packet processing the performance of&lt;br /&gt;
live traffic analysis may be lower.&lt;br /&gt;
When set to 0 a lower priority is used for capture analysis than for live analysis&lt;br /&gt;
but it cannot be ruled out that the performance of the live processing is&lt;br /&gt;
affected.&lt;br /&gt;
&lt;br /&gt;
=== Load balancing ===&lt;br /&gt;
&lt;br /&gt;
This option select the load distribution method. By default, network&lt;br /&gt;
traffic is balanced among all processing threads based on the IP&lt;br /&gt;
addresses. This is fast and usually the best way for good load&lt;br /&gt;
balancing.&lt;br /&gt;
&lt;br /&gt;
If the network traffic only happens between few IP addresses, this&lt;br /&gt;
method can lead to load imbalance so that some threads doing much more&lt;br /&gt;
work while other threads may idle. In this scenario the &amp;quot;flow based&lt;br /&gt;
balancing&amp;quot; can be enabled to distribute the traffic based on the IP&lt;br /&gt;
and port information. This will lead to better utilization of all&lt;br /&gt;
processing threads.&lt;br /&gt;
&lt;br /&gt;
Since this option induces additional processing overhead per packet&lt;br /&gt;
and additional memory for all internal IP statistics, it should only&lt;br /&gt;
be enabled in cases of significant load imbalance.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Global_settings&amp;diff=2839</id>
		<title>Global settings</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Global_settings&amp;diff=2839"/>
		<updated>2020-05-22T15:01:15Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* Packet processing mode */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;The Global settings section contains parameters for adjusting the behavior of the system.&lt;br /&gt;
The settings are split among multiple tabs, described as follows.&lt;br /&gt;
&lt;br /&gt;
== Generic settings ==&lt;br /&gt;
&lt;br /&gt;
=== Packet processing mode ===&lt;br /&gt;
&lt;br /&gt;
This section allows for configuring the main packet processing mode:&lt;br /&gt;
&lt;br /&gt;
* Bridge mode: In Bridge mode, all received packets will be retransmitted on the corresponding mutual port so that the device can be placed inline between any network component. The device will be transparent and will not modify the traffic in any way. The additional latency will be typically around or less than 1 millisecond.&lt;br /&gt;
* Sink mode: In Sink mode, packets are only received and not forwarded. This operation mode allows for installation at a Mirror port of a Switch or when using a network Tap to access the network traffic.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The packet processing mode can be changed during runtime.&lt;br /&gt;
&lt;br /&gt;
=== Webshark support ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter allows having a preview of the first Megabyte of packets directly in the browser, called Webshark. To support this, the system needs a small amount of system memory to process the packets. This amount of memory (~100MB) will be reserved by the system and is not available for the In-Memory database used to store metadata, thus the history of stored metadata is a bit shorter. If this is not desired, it is possible to disable the Webshark support. Changing this value requires a restart of the processing.&lt;br /&gt;
&lt;br /&gt;
=== Limit module processing ===&lt;br /&gt;
&lt;br /&gt;
This setting allows to configure which modules are active. With this setting, the performance of the Allegro Network Multimeter can be drastically improved and allows a higher throughput if you don’t need some analysis modules.&lt;br /&gt;
&lt;br /&gt;
Following modes are possible:&lt;br /&gt;
&lt;br /&gt;
* Only capturing: Only interface statistics and the capture module is provided. The capture filters are support except layer 7 protocol recognition.&lt;br /&gt;
* Up to layer 2: Additionally all layer 2 related modules are active such as MAC, MAC protocols, ARP and Burst Analysis.&lt;br /&gt;
* Up to layer 3: Additionally all layer 3 related modules are active such as IP and DHCP statistics.&lt;br /&gt;
* Up to layer 4: Additionally all layer 4 related modules are active such as TCP and Layer 4 server ports.&lt;br /&gt;
* Unlimited: All modules are active.&lt;br /&gt;
&lt;br /&gt;
When switching to another mode you have to restart the processing in order to activate the new settings.&lt;br /&gt;
&lt;br /&gt;
=== Graph detail settings ===&lt;br /&gt;
&lt;br /&gt;
It is possible to modify the detail level of all graphs in the interface. This settings allow to get a more detailed view (with higher time resolution) or to reduce the detail level so that more data can be stored on the device. Changing the default values have an impact on the performance and memory usage. Changing a slider to the left increases detail level of graphs, but also increases the memory usage and decreases the performance.&lt;br /&gt;
&lt;br /&gt;
* Best graph resolution: This option configures how detailed the graph information are shown in the best case (the latest information). The default value is one second which means that a graph sample point represents a second of packet time. You can change the resolution up to 1 millisecond which gives a detailed sub-second representation of the traffic. You can also decide to decrease the resolution which enables the Multimeter to store more data for a longer period of time.&lt;br /&gt;
&lt;br /&gt;
* Reduce graph resolution of old data by up to: The resolution of older graph data is automatically reduced to save memory and to allow a longer view into the traffic history. This option allows to change this behavior. With a reduction factor of 1/1 no reduction is done at all which means the selected graph resolution is available for the complete time. &lt;br /&gt;
:This of course reduces the time period to see historical data. You can also choose to increase the reduction factor to be able to store more data for a longer time. The time printed in parentheses represents the worst-case graph resolution based on the chosen resolution and reduction factor.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Note: Regardless of these settings, the graph values are always converted to represent a value per second (when applicable). For example, the packets per second for IP addresses will always be a value literally per second even if the resolution is larger or smaller than one second. The shown value is scaled to match this view. Especially with sub-second resolution this might be misleading. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
For instance, if there is a network element sending one packet per second and the resolution is set to 100 millisecond, the value might be shown as 10 packets per second as each sample point is scaled to represent an value per second. For a detailed investigation it is recommended to select a specific time interval since the total packet counters shown in all statistics are unscaled and represent the actual values.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Performance implications: The performance degradation and memory usage depends on the actual network traffic and is not exactly predictable. &lt;br /&gt;
&lt;br /&gt;
Here are some examples for reference on a Multimeter 1000 series with different configuration values (under ideal test conditions):&lt;br /&gt;
&lt;br /&gt;
* 1 second resolution, 1/1 reduction factor: 90% of default performance&lt;br /&gt;
* 100 millisecond resolution, 1/1 reduction factor: 50% of default performance,&lt;br /&gt;
* 10 millisecond resolution, 1/1 reduction factor: 15% of default performance&lt;br /&gt;
* 1 millisecond resolution, 1/1 reduction factor: 10% of default performance&lt;br /&gt;
&lt;br /&gt;
=== pcap parallel analysis ===&lt;br /&gt;
&lt;br /&gt;
The pcap parallel analysis feature allows to analyse pcap files or the&lt;br /&gt;
packet ring buffer in parallel to the live measurement. The settings&lt;br /&gt;
allow to enable the feature and choose how much memory of the main&lt;br /&gt;
memory is used for parallel analysis and how many parallel slots can&lt;br /&gt;
be used. Detailed description of the configuration values are&lt;br /&gt;
described [[pcap parallel analysis|here]].&lt;br /&gt;
&lt;br /&gt;
== IPFIX settings ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter may be running as an IPFIX exporter. These settings allows configuration of reporting. When enabled, following settings are possible:&lt;br /&gt;
&lt;br /&gt;
* IP address: Address of IPFIX collector&lt;br /&gt;
* Port: Corresponding port&lt;br /&gt;
* Protocol: TCP or UDP&lt;br /&gt;
* Update interval: Interval in seconds for sending a status update of flows&lt;br /&gt;
* UDP resend interval: Interval in seconds for resending IPFIX templates for UDP connections&lt;br /&gt;
* TCP reconnect timeout: When TCP connection could not be established, wait for this time period until next try to establish a connection.&lt;br /&gt;
&lt;br /&gt;
Individual IPFIX messages can be enabled or disabled by toggling corresponding options. See the NetFlow/IPFIX interface documentation for details about the message types.&lt;br /&gt;
&lt;br /&gt;
== Time settings ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can be configured to use a time synchronization service. NTP is supported for all variants of the Multimeter, PTP service may be used if management interface supports hardware time stamping.&lt;br /&gt;
In case a GPS capable PTP grandmaster card is available, GPS time synchronization is available and the antenna cable delay in nanoseconds can be configured.&lt;br /&gt;
&lt;br /&gt;
To enable a time service, switch to the proper type in the dropdown box.&lt;br /&gt;
The time service field will show whether the selected service is running or not.&lt;br /&gt;
For NTP time retrieval you can specify and edit dedicated NTP servers. If you do not specify a NTP server, a set of predefined NTP servers will be taken automatically.&lt;br /&gt;
For PTP time retrieval, the PTP grandmaster clock identity is shown. This is usually an EUI-64 address. The first and last set of octets of the identity represent the (EUI-48) MAC address of the grandmaster.&lt;br /&gt;
&lt;br /&gt;
Following settings are possible for PTP and should match to the settings of the PTP grandmaster:&lt;br /&gt;
&lt;br /&gt;
* Delay mechanism: Use end-to-end (E2E), peer-to-peer (P2P) or automatic delay measurement. In case automatic measurement is selected, E2E is used at the beginning and switched to P2P when a peer delay request is received. Default is &#039;&#039;&#039;Auto&#039;&#039;&#039;.&lt;br /&gt;
* Network transport: Use UDPv4, UDPv6 or Layer 2 as network transport. Default is &#039;&#039;&#039;UDPv4&#039;&#039;&#039;.&lt;br /&gt;
* Domain number: The domain number of the grandmaster. This is used to define logical groups of synchronized clocks.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The GPS time retrieval option is available if a GPS capable PTP grandmaster card is installed in the Multimeter. &lt;br /&gt;
If no time synchronization mechanism is selected the date and time of the device can be configured manually by entering a properly formatted date and time description.&lt;br /&gt;
Below the time synchronization settings the time zone used by the device can be configured. The drop-down list provides a list of cities grouped by world regions to select the appropriate time zone from.&lt;br /&gt;
To make changes take effect, click on the Save settings button on the bottom of the page. To reload the stored settings, click on Reload settings.&lt;br /&gt;
&lt;br /&gt;
== Email notification ==&lt;br /&gt;
&lt;br /&gt;
Certain modules support the sending of email notifications. The following settings are used to globally configure the used SMTP server and the target email address that will receive the notifications:&lt;br /&gt;
&lt;br /&gt;
* Enable email notifications: globally enables or disables the sending of email notifications.&lt;br /&gt;
* SMTP server address: the address of the SMTP server that will be used to send out notification emails.&lt;br /&gt;
* SMTP server port: the TCP port on which the SMTP server is listening.&lt;br /&gt;
* SMTP server uses SSL: must be set to On if the SMTP server expects an SSL connection from the very start. If the SMTP server uses no SSL or STARTTLS this setting must be set to Off.&lt;br /&gt;
* Ignore certificate errors: if the SSL certificate should not be validated because e.g. it is a self-signed certificate this setting can be used to turn off certificate validation.&lt;br /&gt;
* Allow unencrypted connections: if an unencrypted connection must be allowed because e.g. a legacy SMTP server does not support it this setting can be used.&lt;br /&gt;
* Username: the username used to log in to the SMTP server.&lt;br /&gt;
* Password: the password used to log in to the SMTP server.&lt;br /&gt;
* From email address: the email address from which incident notifications will be sent.&lt;br /&gt;
* Target email address: the email address to which incident notifications will be sent.&lt;br /&gt;
* Email links base URL: this base URL will be used to generate the HTML links in notification emails. Since the device cannot by itself determine the proper address by which it is visible to the email recipient this setting can be used to set the right URL prefix for links sent with the notification emails.&lt;br /&gt;
* Send periodic system status mail: if set to hourly or daily a system status email will be sent to the configured target address with the selected frequency. It will contain basic system information and system health status, management interface configuration and a list of detected LLDP neighbors if the management LLDP feature is enabled.&lt;br /&gt;
&lt;br /&gt;
The Send test email button can be used to verify that the entered settings are working.&lt;br /&gt;
&lt;br /&gt;
== Expert settings ==&lt;br /&gt;
&lt;br /&gt;
The Expert settings contains parameter which are often only necessary to change in rare installation scenarios or some specific need for a different operation mode.&lt;br /&gt;
&lt;br /&gt;
=== Packet length accounting ===&lt;br /&gt;
&lt;br /&gt;
This setting allows to configure which packet length is used for all traffic counters and incidents. Following modes are possible:&lt;br /&gt;
&lt;br /&gt;
* Layer 1: Packet length is accounted on layer 1 including preamble (7 Byte), SFD (1 Byte) and inter frame gap (12 Byte)&lt;br /&gt;
* Layer 2 without frame check sequence (default): Packet length is accounted on layer 2 without frame check sequence (4 Byte)&lt;br /&gt;
* Layer 2 with frame check sequence: Account packet length on layer 2 with frame check sequence (4 Byte) When switching to another mode, it will only be applied on new packets. Older packet size statistics will not be changed.&lt;br /&gt;
&lt;br /&gt;
=== VLAN handling ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can ignore VLAN tags for connection tracking. Enabling this option might be necessary if network traffic is seen on the Network Multimeter that contains changing VLAN tags for the same connection. For example, depending on the configuration of the mirror port to which the Network Multimeter is connected, incoming traffic could contain a VLAN tag while outgoing traffic does not. In this example, a connection would appear two times in the statistics which is often the desired behavior to be able to identify a network misconfiguration. But sometimes this behavior is intended and the user want to see only one connection. In this scenario the option can be enabled to ignore varying VLAN tags for a otherwise identical connection.&lt;br /&gt;
&lt;br /&gt;
=== Tunnel view mode ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can decapsulate ERSPAN type II and type III traffic. In this mode all non-ERSPAN traffic is being discarded. On the dashboard a dropped counter will display dropped non ERSPAN packets for indication if this mode is active. The Multimeter will show the encapsulated content in all analysis modules. When capturing, packets with complete outer layer 2, layer 3, GRE and ERSPAN headers will be stored as seen on the wire.&lt;br /&gt;
&lt;br /&gt;
=== Database mode settings ===&lt;br /&gt;
&lt;br /&gt;
The database mode is a special analysis mode for high-performance Network Multimeters with multiple processors to increase the performance on such systems. It is normally enabled automatically but depending on the actual network traffic and system usage, some parameter tweak might be necessary to improve overall system performance. &lt;br /&gt;
You should only change these parameters in discussion with the Allegro Packets support.&lt;br /&gt;
These settings are only visible if your Network Multimeter is capable of running this mode.&lt;br /&gt;
&lt;br /&gt;
You can read more about the meaning of the settings [[DB mode|here]].&lt;br /&gt;
&lt;br /&gt;
=== Network performance ===&lt;br /&gt;
&lt;br /&gt;
There are several network performance settings available to improve performance on high-performance systems in case of packet drops during very high receive bandwidth. They are only visible if your Network Multimeter is capable of changing these settings.&lt;br /&gt;
&lt;br /&gt;
* Max RX queues per socket: This setting specifies the amount of threads dedicated to read and write interactions with the network interface controllers. By increasing this value, network receive bandwidth can be increased before packet drops occur. By decreasing this value, data analysis will improve. The default setting of 2 RX queues is suitable for most configurations as data analysis typically needs much more processing ressources.&lt;br /&gt;
* Use Hyper-Threading for RX queues: This setting allows enabling or disabling Hyper-Threading for the threads dedicated to read and write interactions with the network interface controllers. By disabling it, network performance can be improved as the RX queues will be distributed to physical CPU cores only. By enabling it, RX queues will also be distributed to virtual Hyper-Threading CPU cores which is not as efficient as physical CPU cores. By using Hyper-Threading, data analysis will improve as there are more CPU cores available for these tasks. Hyper-Threading is used by default. This is suitable for most configurations as data analysis typically needs much more processing ressources.&lt;br /&gt;
* Preferred Network interface controller: This setting allows fine tuning of network and data analysis performance for dedicated network controllers. The selected set of network controllers will be preferred over the others. Usually the fastest or the network controller with the most traffic should be preferred. The &#039;&#039;&#039;Auto&#039;&#039;&#039; setting is used by default, preferring the fastest network controller.&lt;br /&gt;
&lt;br /&gt;
You should only change these parameters in discussion with the Allegro Packets support.&lt;br /&gt;
&lt;br /&gt;
=== Processing performance ===&lt;br /&gt;
&lt;br /&gt;
The processing performance may be modified on high-performance systems. This is only visible if your Network Multimeter is capable of changing this setting.&lt;br /&gt;
&lt;br /&gt;
* Processing performance mode: This setting allows for fine tuning processing performance. By using &#039;&#039;&#039;Analysing&#039;&#039;&#039;, as much processing ressources on all CPUs as possible are used for data analysis. By using &#039;&#039;&#039;Capturing&#039;&#039;&#039;, the focus will be on high data throughput and low latency for capturing purposes by using only the CPU where the preferred newtork controller is attached to. This has an impact on data analysis performance. &#039;&#039;&#039;Analysing&#039;&#039;&#039; is used by default.&lt;br /&gt;
You should only change this parameter in discussion with the Allegro Packets support.&lt;br /&gt;
&lt;br /&gt;
=== Packet ring buffer timeouts ===&lt;br /&gt;
&lt;br /&gt;
Two timeout settings related to the packet ring buffer can be adjusted.&lt;br /&gt;
&lt;br /&gt;
* The long timeout controls after which maximum period of time a packet is actually written to the packet ring buffer. A lower value may decrease the time difference by which packets are stored out of their real order in the packet ring buffer but it may also increase the amount of unused overhead data in the packet ring buffer.&lt;br /&gt;
* The short timeout controls after which period of time smaller batches of packets are written to the packet ring buffer even if waiting for more packets would result in a more efficient operation. A lower value may decrease the time difference by which packets are stored out of their real order in the packet ring buffer but it may also decrease the performance of the packet ring buffer.&lt;br /&gt;
&lt;br /&gt;
=== Data retention timeout ===&lt;br /&gt;
&lt;br /&gt;
When this timeout is set to a value greater than 0, data will be removed from the system after the given number of minutes. This means that entities like IPs, which have been inactive for longer than the timeout, will be removed. History graph data for entities that are still active will be truncated to cover only the given timespan while the absolute values for the whole runtime will be retained. When a packet ring buffer is active, packets which are older than the timeout will be discarded.&lt;br /&gt;
&lt;br /&gt;
=== L3 tunnel mode ===&lt;br /&gt;
&lt;br /&gt;
If L3 tunnel mode is enabled for an interface this interface will only process packets encapsulated in GRE or GRE+ERSPAN and targeted for the configured IP address. All other packets received on that interface will be discarded. The system will process the packets as if only the inner encapsulated packet is seen and any traffic captures will only contain the encapsulated packet. An interface with L3 tunnel mode enabled will respond to ARP requests and to ICMP echo requests so it is possible to use ping to verify that the interface is reachable under the configured IP address. Currently only IPv4 L3 tunnels are supported. It must be noted that if the system is running in bridge packet processing mode any links with an interface configured for L3 tunnel mode will not forward traffic.&lt;br /&gt;
&lt;br /&gt;
=== Multithreaded capture analysis ===&lt;br /&gt;
&lt;br /&gt;
This option enables the use of multiple CPUs for capture analysis like when&lt;br /&gt;
analyzing a PCAP capture file or analyzing the packet ring buffer. Depending&lt;br /&gt;
on the number of available CPUs this can speed up the analysis significantly.&lt;br /&gt;
&lt;br /&gt;
It is possible to dedicate a number a CPUs exclusively to capture analysis.&lt;br /&gt;
Since these CPUs are not available for live packet processing the performance of&lt;br /&gt;
live traffic analysis may be lower.&lt;br /&gt;
When set to 0 a lower priority is used for capture analysis than for live analysis&lt;br /&gt;
but it cannot be ruled out that the performance of the live processing is&lt;br /&gt;
affected.&lt;br /&gt;
&lt;br /&gt;
=== Load balancing ===&lt;br /&gt;
&lt;br /&gt;
This option select the load distribution method. By default, network&lt;br /&gt;
traffic is balanced among all processing threads based on the IP&lt;br /&gt;
addresses. This is fast and usually the best way for good load&lt;br /&gt;
balancing.&lt;br /&gt;
&lt;br /&gt;
If the network traffic only happens between few IP addresses, this&lt;br /&gt;
method can lead to load imbalance so that some threads doing much more&lt;br /&gt;
work while other threads may idle. In this scenario the &amp;quot;flow based&lt;br /&gt;
balancing&amp;quot; can be enabled to distribute the traffic based on the IP&lt;br /&gt;
and port information. This will lead to better utilization of all&lt;br /&gt;
processing threads.&lt;br /&gt;
&lt;br /&gt;
Since this option induces additional processing overhead per packet&lt;br /&gt;
and additional memory for all internal IP statistics, it should only&lt;br /&gt;
be enabled in cases of significant load imbalance.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Global_settings&amp;diff=2838</id>
		<title>Global settings</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Global_settings&amp;diff=2838"/>
		<updated>2020-05-22T14:59:04Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* PCAP parallel analysis */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;The Global settings section contains parameters for adjusting the behavior of the system.&lt;br /&gt;
The settings are split among multiple tabs, described as follows.&lt;br /&gt;
&lt;br /&gt;
== Generic settings ==&lt;br /&gt;
&lt;br /&gt;
=== Packet processing mode ===&lt;br /&gt;
&lt;br /&gt;
This section allows for configuring the main packet processing mode:&lt;br /&gt;
&lt;br /&gt;
* Bridge mode: In bridge mode, all received packets will be transmitted again on the corresponding mutual port so that the device can be placed in-line between any network component. The device will be transparent and will not modify the traffic in any way. The additional latency will be typically around or less than 1 millisecond.&lt;br /&gt;
* Sink mode: In sink mode, packets are only received and not forwarded. This operation mode allows for installation at a mirror port of a switch or when using a network tap to access the network traffic.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The packet processing mode can be changed during run-time.&lt;br /&gt;
&lt;br /&gt;
=== Webshark support ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter allows having a preview of the first Megabyte of packets directly in the browser, called Webshark. To support this, the system needs a small amount of system memory to process the packets. This amount of memory (~100MB) will be reserved by the system and is not available for the In-Memory database used to store metadata, thus the history of stored metadata is a bit shorter. If this is not desired, it is possible to disable the Webshark support. Changing this value requires a restart of the processing.&lt;br /&gt;
&lt;br /&gt;
=== Limit module processing ===&lt;br /&gt;
&lt;br /&gt;
This setting allows to configure which modules are active. With this setting, the performance of the Allegro Network Multimeter can be drastically improved and allows a higher throughput if you don’t need some analysis modules.&lt;br /&gt;
&lt;br /&gt;
Following modes are possible:&lt;br /&gt;
&lt;br /&gt;
* Only capturing: Only interface statistics and the capture module is provided. The capture filters are support except layer 7 protocol recognition.&lt;br /&gt;
* Up to layer 2: Additionally all layer 2 related modules are active such as MAC, MAC protocols, ARP and Burst Analysis.&lt;br /&gt;
* Up to layer 3: Additionally all layer 3 related modules are active such as IP and DHCP statistics.&lt;br /&gt;
* Up to layer 4: Additionally all layer 4 related modules are active such as TCP and Layer 4 server ports.&lt;br /&gt;
* Unlimited: All modules are active.&lt;br /&gt;
&lt;br /&gt;
When switching to another mode you have to restart the processing in order to activate the new settings.&lt;br /&gt;
&lt;br /&gt;
=== Graph detail settings ===&lt;br /&gt;
&lt;br /&gt;
It is possible to modify the detail level of all graphs in the interface. This settings allow to get a more detailed view (with higher time resolution) or to reduce the detail level so that more data can be stored on the device. Changing the default values have an impact on the performance and memory usage. Changing a slider to the left increases detail level of graphs, but also increases the memory usage and decreases the performance.&lt;br /&gt;
&lt;br /&gt;
* Best graph resolution: This option configures how detailed the graph information are shown in the best case (the latest information). The default value is one second which means that a graph sample point represents a second of packet time. You can change the resolution up to 1 millisecond which gives a detailed sub-second representation of the traffic. You can also decide to decrease the resolution which enables the Multimeter to store more data for a longer period of time.&lt;br /&gt;
&lt;br /&gt;
* Reduce graph resolution of old data by up to: The resolution of older graph data is automatically reduced to save memory and to allow a longer view into the traffic history. This option allows to change this behavior. With a reduction factor of 1/1 no reduction is done at all which means the selected graph resolution is available for the complete time. &lt;br /&gt;
:This of course reduces the time period to see historical data. You can also choose to increase the reduction factor to be able to store more data for a longer time. The time printed in parentheses represents the worst-case graph resolution based on the chosen resolution and reduction factor.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Note: Regardless of these settings, the graph values are always converted to represent a value per second (when applicable). For example, the packets per second for IP addresses will always be a value literally per second even if the resolution is larger or smaller than one second. The shown value is scaled to match this view. Especially with sub-second resolution this might be misleading. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
For instance, if there is a network element sending one packet per second and the resolution is set to 100 millisecond, the value might be shown as 10 packets per second as each sample point is scaled to represent an value per second. For a detailed investigation it is recommended to select a specific time interval since the total packet counters shown in all statistics are unscaled and represent the actual values.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Performance implications: The performance degradation and memory usage depends on the actual network traffic and is not exactly predictable. &lt;br /&gt;
&lt;br /&gt;
Here are some examples for reference on a Multimeter 1000 series with different configuration values (under ideal test conditions):&lt;br /&gt;
&lt;br /&gt;
* 1 second resolution, 1/1 reduction factor: 90% of default performance&lt;br /&gt;
* 100 millisecond resolution, 1/1 reduction factor: 50% of default performance,&lt;br /&gt;
* 10 millisecond resolution, 1/1 reduction factor: 15% of default performance&lt;br /&gt;
* 1 millisecond resolution, 1/1 reduction factor: 10% of default performance&lt;br /&gt;
&lt;br /&gt;
=== pcap parallel analysis ===&lt;br /&gt;
&lt;br /&gt;
The pcap parallel analysis feature allows to analyse pcap files or the&lt;br /&gt;
packet ring buffer in parallel to the live measurement. The settings&lt;br /&gt;
allow to enable the feature and choose how much memory of the main&lt;br /&gt;
memory is used for parallel analysis and how many parallel slots can&lt;br /&gt;
be used. Detailed description of the configuration values are&lt;br /&gt;
described [[pcap parallel analysis|here]].&lt;br /&gt;
&lt;br /&gt;
== IPFIX settings ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter may be running as an IPFIX exporter. These settings allows configuration of reporting. When enabled, following settings are possible:&lt;br /&gt;
&lt;br /&gt;
* IP address: Address of IPFIX collector&lt;br /&gt;
* Port: Corresponding port&lt;br /&gt;
* Protocol: TCP or UDP&lt;br /&gt;
* Update interval: Interval in seconds for sending a status update of flows&lt;br /&gt;
* UDP resend interval: Interval in seconds for resending IPFIX templates for UDP connections&lt;br /&gt;
* TCP reconnect timeout: When TCP connection could not be established, wait for this time period until next try to establish a connection.&lt;br /&gt;
&lt;br /&gt;
Individual IPFIX messages can be enabled or disabled by toggling corresponding options. See the NetFlow/IPFIX interface documentation for details about the message types.&lt;br /&gt;
&lt;br /&gt;
== Time settings ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can be configured to use a time synchronization service. NTP is supported for all variants of the Multimeter, PTP service may be used if management interface supports hardware time stamping.&lt;br /&gt;
In case a GPS capable PTP grandmaster card is available, GPS time synchronization is available and the antenna cable delay in nanoseconds can be configured.&lt;br /&gt;
&lt;br /&gt;
To enable a time service, switch to the proper type in the dropdown box.&lt;br /&gt;
The time service field will show whether the selected service is running or not.&lt;br /&gt;
For NTP time retrieval you can specify and edit dedicated NTP servers. If you do not specify a NTP server, a set of predefined NTP servers will be taken automatically.&lt;br /&gt;
For PTP time retrieval, the PTP grandmaster clock identity is shown. This is usually an EUI-64 address. The first and last set of octets of the identity represent the (EUI-48) MAC address of the grandmaster.&lt;br /&gt;
&lt;br /&gt;
Following settings are possible for PTP and should match to the settings of the PTP grandmaster:&lt;br /&gt;
&lt;br /&gt;
* Delay mechanism: Use end-to-end (E2E), peer-to-peer (P2P) or automatic delay measurement. In case automatic measurement is selected, E2E is used at the beginning and switched to P2P when a peer delay request is received. Default is &#039;&#039;&#039;Auto&#039;&#039;&#039;.&lt;br /&gt;
* Network transport: Use UDPv4, UDPv6 or Layer 2 as network transport. Default is &#039;&#039;&#039;UDPv4&#039;&#039;&#039;.&lt;br /&gt;
* Domain number: The domain number of the grandmaster. This is used to define logical groups of synchronized clocks.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The GPS time retrieval option is available if a GPS capable PTP grandmaster card is installed in the Multimeter. &lt;br /&gt;
If no time synchronization mechanism is selected the date and time of the device can be configured manually by entering a properly formatted date and time description.&lt;br /&gt;
Below the time synchronization settings the time zone used by the device can be configured. The drop-down list provides a list of cities grouped by world regions to select the appropriate time zone from.&lt;br /&gt;
To make changes take effect, click on the Save settings button on the bottom of the page. To reload the stored settings, click on Reload settings.&lt;br /&gt;
&lt;br /&gt;
== Email notification ==&lt;br /&gt;
&lt;br /&gt;
Certain modules support the sending of email notifications. The following settings are used to globally configure the used SMTP server and the target email address that will receive the notifications:&lt;br /&gt;
&lt;br /&gt;
* Enable email notifications: globally enables or disables the sending of email notifications.&lt;br /&gt;
* SMTP server address: the address of the SMTP server that will be used to send out notification emails.&lt;br /&gt;
* SMTP server port: the TCP port on which the SMTP server is listening.&lt;br /&gt;
* SMTP server uses SSL: must be set to On if the SMTP server expects an SSL connection from the very start. If the SMTP server uses no SSL or STARTTLS this setting must be set to Off.&lt;br /&gt;
* Ignore certificate errors: if the SSL certificate should not be validated because e.g. it is a self-signed certificate this setting can be used to turn off certificate validation.&lt;br /&gt;
* Allow unencrypted connections: if an unencrypted connection must be allowed because e.g. a legacy SMTP server does not support it this setting can be used.&lt;br /&gt;
* Username: the username used to log in to the SMTP server.&lt;br /&gt;
* Password: the password used to log in to the SMTP server.&lt;br /&gt;
* From email address: the email address from which incident notifications will be sent.&lt;br /&gt;
* Target email address: the email address to which incident notifications will be sent.&lt;br /&gt;
* Email links base URL: this base URL will be used to generate the HTML links in notification emails. Since the device cannot by itself determine the proper address by which it is visible to the email recipient this setting can be used to set the right URL prefix for links sent with the notification emails.&lt;br /&gt;
* Send periodic system status mail: if set to hourly or daily a system status email will be sent to the configured target address with the selected frequency. It will contain basic system information and system health status, management interface configuration and a list of detected LLDP neighbors if the management LLDP feature is enabled.&lt;br /&gt;
&lt;br /&gt;
The Send test email button can be used to verify that the entered settings are working.&lt;br /&gt;
&lt;br /&gt;
== Expert settings ==&lt;br /&gt;
&lt;br /&gt;
The Expert settings contains parameter which are often only necessary to change in rare installation scenarios or some specific need for a different operation mode.&lt;br /&gt;
&lt;br /&gt;
=== Packet length accounting ===&lt;br /&gt;
&lt;br /&gt;
This setting allows to configure which packet length is used for all traffic counters and incidents. Following modes are possible:&lt;br /&gt;
&lt;br /&gt;
* Layer 1: Packet length is accounted on layer 1 including preamble (7 Byte), SFD (1 Byte) and inter frame gap (12 Byte)&lt;br /&gt;
* Layer 2 without frame check sequence (default): Packet length is accounted on layer 2 without frame check sequence (4 Byte)&lt;br /&gt;
* Layer 2 with frame check sequence: Account packet length on layer 2 with frame check sequence (4 Byte) When switching to another mode, it will only be applied on new packets. Older packet size statistics will not be changed.&lt;br /&gt;
&lt;br /&gt;
=== VLAN handling ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can ignore VLAN tags for connection tracking. Enabling this option might be necessary if network traffic is seen on the Network Multimeter that contains changing VLAN tags for the same connection. For example, depending on the configuration of the mirror port to which the Network Multimeter is connected, incoming traffic could contain a VLAN tag while outgoing traffic does not. In this example, a connection would appear two times in the statistics which is often the desired behavior to be able to identify a network misconfiguration. But sometimes this behavior is intended and the user want to see only one connection. In this scenario the option can be enabled to ignore varying VLAN tags for a otherwise identical connection.&lt;br /&gt;
&lt;br /&gt;
=== Tunnel view mode ===&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can decapsulate ERSPAN type II and type III traffic. In this mode all non-ERSPAN traffic is being discarded. On the dashboard a dropped counter will display dropped non ERSPAN packets for indication if this mode is active. The Multimeter will show the encapsulated content in all analysis modules. When capturing, packets with complete outer layer 2, layer 3, GRE and ERSPAN headers will be stored as seen on the wire.&lt;br /&gt;
&lt;br /&gt;
=== Database mode settings ===&lt;br /&gt;
&lt;br /&gt;
The database mode is a special analysis mode for high-performance Network Multimeters with multiple processors to increase the performance on such systems. It is normally enabled automatically but depending on the actual network traffic and system usage, some parameter tweak might be necessary to improve overall system performance. &lt;br /&gt;
You should only change these parameters in discussion with the Allegro Packets support.&lt;br /&gt;
These settings are only visible if your Network Multimeter is capable of running this mode.&lt;br /&gt;
&lt;br /&gt;
You can read more about the meaning of the settings [[DB mode|here]].&lt;br /&gt;
&lt;br /&gt;
=== Network performance ===&lt;br /&gt;
&lt;br /&gt;
There are several network performance settings available to improve performance on high-performance systems in case of packet drops during very high receive bandwidth. They are only visible if your Network Multimeter is capable of changing these settings.&lt;br /&gt;
&lt;br /&gt;
* Max RX queues per socket: This setting specifies the amount of threads dedicated to read and write interactions with the network interface controllers. By increasing this value, network receive bandwidth can be increased before packet drops occur. By decreasing this value, data analysis will improve. The default setting of 2 RX queues is suitable for most configurations as data analysis typically needs much more processing ressources.&lt;br /&gt;
* Use Hyper-Threading for RX queues: This setting allows enabling or disabling Hyper-Threading for the threads dedicated to read and write interactions with the network interface controllers. By disabling it, network performance can be improved as the RX queues will be distributed to physical CPU cores only. By enabling it, RX queues will also be distributed to virtual Hyper-Threading CPU cores which is not as efficient as physical CPU cores. By using Hyper-Threading, data analysis will improve as there are more CPU cores available for these tasks. Hyper-Threading is used by default. This is suitable for most configurations as data analysis typically needs much more processing ressources.&lt;br /&gt;
* Preferred Network interface controller: This setting allows fine tuning of network and data analysis performance for dedicated network controllers. The selected set of network controllers will be preferred over the others. Usually the fastest or the network controller with the most traffic should be preferred. The &#039;&#039;&#039;Auto&#039;&#039;&#039; setting is used by default, preferring the fastest network controller.&lt;br /&gt;
&lt;br /&gt;
You should only change these parameters in discussion with the Allegro Packets support.&lt;br /&gt;
&lt;br /&gt;
=== Processing performance ===&lt;br /&gt;
&lt;br /&gt;
The processing performance may be modified on high-performance systems. This is only visible if your Network Multimeter is capable of changing this setting.&lt;br /&gt;
&lt;br /&gt;
* Processing performance mode: This setting allows for fine tuning processing performance. By using &#039;&#039;&#039;Analysing&#039;&#039;&#039;, as much processing ressources on all CPUs as possible are used for data analysis. By using &#039;&#039;&#039;Capturing&#039;&#039;&#039;, the focus will be on high data throughput and low latency for capturing purposes by using only the CPU where the preferred newtork controller is attached to. This has an impact on data analysis performance. &#039;&#039;&#039;Analysing&#039;&#039;&#039; is used by default.&lt;br /&gt;
You should only change this parameter in discussion with the Allegro Packets support.&lt;br /&gt;
&lt;br /&gt;
=== Packet ring buffer timeouts ===&lt;br /&gt;
&lt;br /&gt;
Two timeout settings related to the packet ring buffer can be adjusted.&lt;br /&gt;
&lt;br /&gt;
* The long timeout controls after which maximum period of time a packet is actually written to the packet ring buffer. A lower value may decrease the time difference by which packets are stored out of their real order in the packet ring buffer but it may also increase the amount of unused overhead data in the packet ring buffer.&lt;br /&gt;
* The short timeout controls after which period of time smaller batches of packets are written to the packet ring buffer even if waiting for more packets would result in a more efficient operation. A lower value may decrease the time difference by which packets are stored out of their real order in the packet ring buffer but it may also decrease the performance of the packet ring buffer.&lt;br /&gt;
&lt;br /&gt;
=== Data retention timeout ===&lt;br /&gt;
&lt;br /&gt;
When this timeout is set to a value greater than 0, data will be removed from the system after the given number of minutes. This means that entities like IPs, which have been inactive for longer than the timeout, will be removed. History graph data for entities that are still active will be truncated to cover only the given timespan while the absolute values for the whole runtime will be retained. When a packet ring buffer is active, packets which are older than the timeout will be discarded.&lt;br /&gt;
&lt;br /&gt;
=== L3 tunnel mode ===&lt;br /&gt;
&lt;br /&gt;
If L3 tunnel mode is enabled for an interface this interface will only process packets encapsulated in GRE or GRE+ERSPAN and targeted for the configured IP address. All other packets received on that interface will be discarded. The system will process the packets as if only the inner encapsulated packet is seen and any traffic captures will only contain the encapsulated packet. An interface with L3 tunnel mode enabled will respond to ARP requests and to ICMP echo requests so it is possible to use ping to verify that the interface is reachable under the configured IP address. Currently only IPv4 L3 tunnels are supported. It must be noted that if the system is running in bridge packet processing mode any links with an interface configured for L3 tunnel mode will not forward traffic.&lt;br /&gt;
&lt;br /&gt;
=== Multithreaded capture analysis ===&lt;br /&gt;
&lt;br /&gt;
This option enables the use of multiple CPUs for capture analysis like when&lt;br /&gt;
analyzing a PCAP capture file or analyzing the packet ring buffer. Depending&lt;br /&gt;
on the number of available CPUs this can speed up the analysis significantly.&lt;br /&gt;
&lt;br /&gt;
It is possible to dedicate a number a CPUs exclusively to capture analysis.&lt;br /&gt;
Since these CPUs are not available for live packet processing the performance of&lt;br /&gt;
live traffic analysis may be lower.&lt;br /&gt;
When set to 0 a lower priority is used for capture analysis than for live analysis&lt;br /&gt;
but it cannot be ruled out that the performance of the live processing is&lt;br /&gt;
affected.&lt;br /&gt;
&lt;br /&gt;
=== Load balancing ===&lt;br /&gt;
&lt;br /&gt;
This option select the load distribution method. By default, network&lt;br /&gt;
traffic is balanced among all processing threads based on the IP&lt;br /&gt;
addresses. This is fast and usually the best way for good load&lt;br /&gt;
balancing.&lt;br /&gt;
&lt;br /&gt;
If the network traffic only happens between few IP addresses, this&lt;br /&gt;
method can lead to load imbalance so that some threads doing much more&lt;br /&gt;
work while other threads may idle. In this scenario the &amp;quot;flow based&lt;br /&gt;
balancing&amp;quot; can be enabled to distribute the traffic based on the IP&lt;br /&gt;
and port information. This will lead to better utilization of all&lt;br /&gt;
processing threads.&lt;br /&gt;
&lt;br /&gt;
Since this option induces additional processing overhead per packet&lt;br /&gt;
and additional memory for all internal IP statistics, it should only&lt;br /&gt;
be enabled in cases of significant load imbalance.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Multi-device_settings&amp;diff=2837</id>
		<title>Multi-device settings</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Multi-device_settings&amp;diff=2837"/>
		<updated>2020-05-22T14:28:07Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;The multi-device feature allows you to access multiple Allegro Network&lt;br /&gt;
Multimeters from a single master appliance. Access to the remote&lt;br /&gt;
Multimeters is routed through the master appliance so the web user does not&lt;br /&gt;
need to have direct access to the target devices.&lt;br /&gt;
&lt;br /&gt;
Features like the [[Path measurement]] also use the multi-device&lt;br /&gt;
settings to access the remote appliance for the measurement.&lt;br /&gt;
&lt;br /&gt;
As soon as a remote multi-device is active, the top menu shows a&lt;br /&gt;
drop-down menu for you to be able to select the current view. All measurement&lt;br /&gt;
data shown in the web interface are from the selected device.&lt;br /&gt;
&lt;br /&gt;
[[File:Ap-mm-multi-device-settings.png|500px|frame|Multi device settings]]&lt;br /&gt;
&lt;br /&gt;
== List of remote devices ==&lt;br /&gt;
&lt;br /&gt;
The first part of the page contains the list of all configured remote&lt;br /&gt;
devices. It shows the host name or IP address for the corresponding device and&lt;br /&gt;
an arbitrary description for each device which can also be changed.&lt;br /&gt;
&lt;br /&gt;
Next to the description, details of the SSL certificate of the remote&lt;br /&gt;
device is shown so it is possible to verify the correct&lt;br /&gt;
certificate.&lt;br /&gt;
&lt;br /&gt;
The last column allows you to activate or deactivate devices and remove&lt;br /&gt;
them completely from the list. Only activated devices are actually&lt;br /&gt;
contacted and made available in the top selection box.&lt;br /&gt;
&lt;br /&gt;
== Add a remote Multimeter ==&lt;br /&gt;
&lt;br /&gt;
Below the list of registered Multimeters, new devices can be added by&lt;br /&gt;
entering the host name or IP address, optionally setting a description&lt;br /&gt;
for the device, and the login credentials.&lt;br /&gt;
&lt;br /&gt;
== Master device description ==&lt;br /&gt;
&lt;br /&gt;
The master device can also have an arbitrary description to make it&lt;br /&gt;
easier to select it from the top selection box.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Administration&amp;diff=2836</id>
		<title>Administration</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Administration&amp;diff=2836"/>
		<updated>2020-05-22T14:24:08Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;The administration page allows the following actions:&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable sortable&amp;quot;&lt;br /&gt;
|- &lt;br /&gt;
| [[File:Administration.png|800px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=== Power ===&lt;br /&gt;
&lt;br /&gt;
Reboot or power off the Allegro Network Multimeter.&lt;br /&gt;
&lt;br /&gt;
After clicking on the buttons, a confirmation dialogue will appear. Most of the time, rebooting is not necessary since it takes a significant time. If packet processing needs to be restarted because some options cannot be changed during runtime, the next option is a better choice since it minimizes downtime.&lt;br /&gt;
&lt;br /&gt;
=== Processing ===&lt;br /&gt;
&lt;br /&gt;
Restart the Allegro Network Multimeter processing software. This will reset all measured statistics.&lt;br /&gt;
&lt;br /&gt;
Choosing this option will stop packet processing but the machine and its web interface is still available as the device itself is not rebooted. The packet processing core is restarted with the current settings and will begin processing packets after a few seconds.&lt;br /&gt;
&lt;br /&gt;
=== Configuration ===&lt;br /&gt;
&lt;br /&gt;
By clicking on Reset &#039;&#039;&#039;System Configuration&#039;&#039;&#039; all settings including the network configuration will be reset to factory default and the system will be restarted.&lt;br /&gt;
&lt;br /&gt;
The &amp;quot;Export System Configuration&amp;quot; button allows you to export the entire configuration of the *Allegro Network Multimeter*. A zip compressed file can be downloaded and used for import.&lt;br /&gt;
&lt;br /&gt;
The &amp;quot;Import System Configuration&amp;quot; button allows you to select several configuration items:&lt;br /&gt;
* All settings: All settings of global settings, module settings, incident settings, user defined names, virtual link groups, NIC filter and IP groups, excluding management interface settings, multi-device settings, and user settings. It is possible to import these settings to all configured remote devices.&lt;br /&gt;
* Management interface settings: All settings of the management interface (e.g. Wi-Fi, LAN, hostname).&lt;br /&gt;
* Multi device settings: All settings on the configured remote devices.&lt;br /&gt;
* Users: All users and their passwords. The admin user cannot be changed and cannot be deleted by a configuration import.&lt;br /&gt;
&lt;br /&gt;
=== SSL certificate ===&lt;br /&gt;
&lt;br /&gt;
The appliance comes with a pre-installed generic SSL certificate but an own certificate can be installed:&lt;br /&gt;
The &#039;&#039;&#039;Install SSL certificate&#039;&#039;&#039; button will open a dialogue that will allow you to upload a X.509 certificate file and a RSA key file. Upon successful upload, this certificate will be used to serve the user interface. &lt;br /&gt;
The &#039;&#039;&#039;Reset to default SSL certificate&#039;&#039;&#039; button will remove any user-provided SSL certificate and the user interface will be served using the default SSL certificate.&lt;br /&gt;
It is currently not possible to issue a signing request procedure. To use a certificate which needs to be signed by a company CA, the user has to create that certificate on a separate machine, create the signing request, and deploy the final certificate to the appliance using the above option.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Ingress_filter&amp;diff=2835</id>
		<title>Ingress filter</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Ingress_filter&amp;diff=2835"/>
		<updated>2020-05-22T14:16:26Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable sortable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
| [[File:NIC filter.png|1000px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
The filter page allows setting a processing filter for live traffic. The traffic may be filtered before it is processed.&lt;br /&gt;
Filters can be applied for:&lt;br /&gt;
* IP addresses (with possible subnet mask).&lt;br /&gt;
* pairs of IP addresses (with possible subnet mask).&lt;br /&gt;
* MAC addresses.&lt;br /&gt;
* VLAN tags (or none for no VLAN tag).&lt;br /&gt;
* specific TCP/UDP ports.&lt;br /&gt;
* physical interface IDs (as listed in Interface statistics).&lt;br /&gt;
&lt;br /&gt;
They can all be set to either blacklist or whitelist mode. &lt;br /&gt;
Filtering will be evaluated for every packet in tab order. &lt;br /&gt;
The more restrictive filter will be applied. &lt;br /&gt;
For instance; if no IP address is denied but a specific MAC address is on the blacklist, no traffic for that MAC address will be  processed.&lt;br /&gt;
The processing filter is applied on live traffic only. When replaying a pcap or using the remote traffic capture feature, filtering is not used.&lt;br /&gt;
&lt;br /&gt;
=== IP filters ===&lt;br /&gt;
&lt;br /&gt;
The IP filter page allows importing an IP list in the format:&lt;br /&gt;
&lt;br /&gt;
 #A line with a comment&lt;br /&gt;
 1.2.3.1&lt;br /&gt;
 1.2.3.2&lt;br /&gt;
 1.2.3.3&lt;br /&gt;
&lt;br /&gt;
By clicking on &#039;&#039;&#039;Import list&#039;&#039;&#039; a dialogue box will be opened where you can choose to download such a list from a given URL or specify a file from your system. The IP addresses are added to the existing ones up to a maximum of 10000 addresses.&lt;br /&gt;
&lt;br /&gt;
The &#039;&#039;&#039;Export list&#039;&#039;&#039; button allows for exporting the IP filter list in the same format as the import.&lt;br /&gt;
&lt;br /&gt;
The &#039;&#039;&#039;Delete all&#039;&#039;&#039; button allows for deleting all IP addresses from the filter list.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Remote_access_and_export&amp;diff=2834</id>
		<title>Remote access and export</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Remote_access_and_export&amp;diff=2834"/>
		<updated>2020-05-22T14:07:39Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* PCAP Export via SFTP */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Statistics Export ==&lt;br /&gt;
&lt;br /&gt;
See [[Statistics Export via POST]] for details about exporting the measurement data via HTTP POST requests.&lt;br /&gt;
&lt;br /&gt;
== SSH port forwarding ==&lt;br /&gt;
&lt;br /&gt;
This option allows to use an external SSH server as an proxy to access the device. Via port forwarding the client PC accesses the SSH proxy which forwards the traffic to the actual Allegro Network Multimeter. See [[Self-hosted_SSH_proxy]] for detailed information how to set up such a server.&lt;br /&gt;
&lt;br /&gt;
== Allegro Remote Service ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Remote Service is similar to the SSH Port Forwarding feature, but the SSH server is provided by Allegro Packets as a public service. Traffic through is proxy is still end-to-end encrypted via your SSL certificate so the data is only accessible to you.&lt;br /&gt;
&lt;br /&gt;
See [[Using the Allegro Remote Service]] for detailed information.&lt;br /&gt;
&lt;br /&gt;
== SNMP ==&lt;br /&gt;
&lt;br /&gt;
See [[SNMP]] for details about SNMP support.&lt;br /&gt;
&lt;br /&gt;
== pcap export via SFTP ==&lt;br /&gt;
&lt;br /&gt;
The &#039;&#039;&#039;Allegro Network Multimeter&#039;&#039;&#039; allows the export of captured pcaps via SFTP.&lt;br /&gt;
pcap files can be stored in an upload queue and be automatically uploaded to a remote host&lt;br /&gt;
once a day.&lt;br /&gt;
&lt;br /&gt;
This feature only works if a disk is attached to the device.&lt;br /&gt;
&lt;br /&gt;
When &#039;&#039;PCAP Export via SFTP&#039;&#039; is enabled, a new checkbox &#039;&#039;Save to SFTP export directory&#039;&#039; is&lt;br /&gt;
added to the capture dialogue. If checked, the pcap will be stored to a special&lt;br /&gt;
upload directory.&lt;br /&gt;
&lt;br /&gt;
In the configuration view, it is possible to see the files in the upload queue and&lt;br /&gt;
delete them or trigger an immediate upload.&lt;br /&gt;
&lt;br /&gt;
SFTP export allows SFTP authentication via public key or via password. The public key&lt;br /&gt;
is printed at the top of the configuration view. For public key authentication, the&lt;br /&gt;
password field in the SFTP connection parameters can be left empty.&lt;br /&gt;
&lt;br /&gt;
A &amp;quot;Test uplaod&amp;quot; button uploads a file &#039;&#039;&#039;allegro-upload-test.txt&#039;&#039;&#039; into the configured&lt;br /&gt;
target directory on the remote host.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Remote_access_and_export&amp;diff=2833</id>
		<title>Remote access and export</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Remote_access_and_export&amp;diff=2833"/>
		<updated>2020-05-22T14:07:15Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* PCAP Export via SFTP */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Statistics Export ==&lt;br /&gt;
&lt;br /&gt;
See [[Statistics Export via POST]] for details about exporting the measurement data via HTTP POST requests.&lt;br /&gt;
&lt;br /&gt;
== SSH port forwarding ==&lt;br /&gt;
&lt;br /&gt;
This option allows to use an external SSH server as an proxy to access the device. Via port forwarding the client PC accesses the SSH proxy which forwards the traffic to the actual Allegro Network Multimeter. See [[Self-hosted_SSH_proxy]] for detailed information how to set up such a server.&lt;br /&gt;
&lt;br /&gt;
== Allegro Remote Service ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Remote Service is similar to the SSH Port Forwarding feature, but the SSH server is provided by Allegro Packets as a public service. Traffic through is proxy is still end-to-end encrypted via your SSL certificate so the data is only accessible to you.&lt;br /&gt;
&lt;br /&gt;
See [[Using the Allegro Remote Service]] for detailed information.&lt;br /&gt;
&lt;br /&gt;
== SNMP ==&lt;br /&gt;
&lt;br /&gt;
See [[SNMP]] for details about SNMP support.&lt;br /&gt;
&lt;br /&gt;
== PCAP Export via SFTP ==&lt;br /&gt;
&lt;br /&gt;
The &#039;&#039;&#039;Allegro Network Multimeter&#039;&#039;&#039; allows the export of captured pcaps via SFTP.&lt;br /&gt;
pcap files can be stored in an upload queue and be automatically uploaded to a remote host&lt;br /&gt;
once a day.&lt;br /&gt;
&lt;br /&gt;
This feature only works if a disk is attached to the device.&lt;br /&gt;
&lt;br /&gt;
When &#039;&#039;PCAP Export via SFTP&#039;&#039; is enabled, a new checkbox &#039;&#039;Save to SFTP export directory&#039;&#039; is&lt;br /&gt;
added to the capture dialogue. If checked, the pcap will be stored to a special&lt;br /&gt;
upload directory.&lt;br /&gt;
&lt;br /&gt;
In the configuration view, it is possible to see the files in the upload queue and&lt;br /&gt;
delete them or trigger an immediate upload.&lt;br /&gt;
&lt;br /&gt;
SFTP export allows SFTP authentication via public key or via password. The public key&lt;br /&gt;
is printed at the top of the configuration view. For public key authentication, the&lt;br /&gt;
password field in the SFTP connection parameters can be left empty.&lt;br /&gt;
&lt;br /&gt;
A &amp;quot;Test uplaod&amp;quot; button uploads a file &#039;&#039;&#039;allegro-upload-test.txt&#039;&#039;&#039; into the configured&lt;br /&gt;
target directory on the remote host.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=License_upload&amp;diff=2832</id>
		<title>License upload</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=License_upload&amp;diff=2832"/>
		<updated>2020-05-22T11:55:39Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&#039;&#039;&#039;Web interface&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
{| class=&amp;quot;wikitable sortable&amp;quot;&lt;br /&gt;
|-&lt;br /&gt;
|[[File:License details.png|800px|none|right]]&lt;br /&gt;
|}&lt;br /&gt;
The Allegro Network Multimeter comes with an installed License which may have some limitations according to the support contract details. A new License can be uploaded by clicking on the upload button and selecting the file from your hard disc. A valid License takes immediate effect.&lt;br /&gt;
&lt;br /&gt;
The shown system serial needs to be sent to Allegro Packets in order to generate a new License if required.&lt;br /&gt;
&lt;br /&gt;
In case of an invalid or expired License, the appliance will stop analyzing traffic; instead it will bypass all packets in Bridge mode to allow continued network connection.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=Self-hosted_SSH_Proxy&amp;diff=2831</id>
		<title>Self-hosted SSH Proxy</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=Self-hosted_SSH_Proxy&amp;diff=2831"/>
		<updated>2020-05-22T11:49:37Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* Option 2: With HTTPS proxy */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== SSH Port Forwarding ==&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter can be configured to to use SSH Port Forwarding to allow remote access to the device behind a NAT. &lt;br /&gt;
The Multimeter will create a tunnel to an SSH endpoint and will open a listening port on the SSH server. &lt;br /&gt;
This port can now be used to send HTTPS requests to the Multimeter.&lt;br /&gt;
&lt;br /&gt;
=== Preparing the SSH server ===&lt;br /&gt;
&lt;br /&gt;
==== Create a user ====&lt;br /&gt;
&lt;br /&gt;
The user on the SSH server does not need any special rights and does not need a login shell. Example:&lt;br /&gt;
&lt;br /&gt;
 $&amp;gt; useradd -m -s /usr/sbin/nologin mmremote&lt;br /&gt;
&lt;br /&gt;
==== Allow SSH access via public key ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter uses SSH public key authentication to log in to the SSH server. The public key can be found in the &#039;&#039;&#039;SSH public key&#039;&#039;&#039; field in the &#039;&#039;&#039;SSH Port Forwarding&#039;&#039;&#039; settings dialogue.&lt;br /&gt;
&lt;br /&gt;
 $&amp;gt; mkdir /home/mmremote/.ssh&lt;br /&gt;
 $&amp;gt; chown mmremote: /home/mmremote/.ssh&lt;br /&gt;
 $&amp;gt; nano /etc/mmremote/.ssh/authorized_keys&lt;br /&gt;
&lt;br /&gt;
Paste the line into the file and save/close the file.&lt;br /&gt;
There are two options to access the Multimeter:&lt;br /&gt;
&lt;br /&gt;
==== Option 1: No proxy ====&lt;br /&gt;
&lt;br /&gt;
Advantage:&lt;br /&gt;
* no additional software required.&lt;br /&gt;
&lt;br /&gt;
Disadvantage:&lt;br /&gt;
* no port &amp;lt; 1024 (as non-root user).&lt;br /&gt;
* Default HTTPS port 443 is not possible.&lt;br /&gt;
&lt;br /&gt;
The SSH server can be configured to allow only local listening ports. This has to be changed to allow listening on any subnet.&lt;br /&gt;
&lt;br /&gt;
Edit the SSH configuration file &#039;&#039;&#039;/etc/ssh/sshd_config&#039;&#039;&#039; and activate the following line:&lt;br /&gt;
&lt;br /&gt;
&amp;lt;code&amp;gt;GatewayPorts clientspecified&amp;lt;/code&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Save and close the configuration file and restart the SSH service.&lt;br /&gt;
&lt;br /&gt;
==== Option 2: With HTTPS proxy ====&lt;br /&gt;
&lt;br /&gt;
Advantage:&lt;br /&gt;
* uses default HTTPS port 443.&lt;br /&gt;
* uses several filter mechanisms provided by the proxy software.&lt;br /&gt;
* uses the same SSH server as proxy for several Multimeters through SNI routing.&lt;br /&gt;
&lt;br /&gt;
Disadvantage:&lt;br /&gt;
* additional configuration required.&lt;br /&gt;
&lt;br /&gt;
The following block shows a sample configuration for the &#039;&#039;&#039;nginx&#039;&#039;&#039; proxy server:&lt;br /&gt;
&lt;br /&gt;
 server {&lt;br /&gt;
         listen 443 ssl;&lt;br /&gt;
         listen [::]:443 ssl;&lt;br /&gt;
 &lt;br /&gt;
         server_name allegro-mm-1234.mm-remote.company.com;&lt;br /&gt;
 &lt;br /&gt;
         ssl_certificate /etc/letsencrypt/live/allegro-mm-1234.mm-remote.company.com/fullchain.pem;&lt;br /&gt;
         ssl_certificate_key /etc/letsencrypt/live/allegro-mm-1234.mm-remote.company.com/privkey.pem;&lt;br /&gt;
 &lt;br /&gt;
         location / {&lt;br /&gt;
                      proxy_pass        https://localhost:55443; # 55443 =configured listen port on multimeter&lt;br /&gt;
                     }&lt;br /&gt;
         client_max_body_size 200M; # for firmware uploads&lt;br /&gt;
 }&lt;br /&gt;
 server {&lt;br /&gt;
        listen 80;&lt;br /&gt;
        listen [::]:80;&lt;br /&gt;
         &lt;br /&gt;
        server_name allegro-mm-1234.mm-remote.company.com;&lt;br /&gt;
 &lt;br /&gt;
        return 301 https://$host$request_uri;&lt;br /&gt;
 }&lt;br /&gt;
&lt;br /&gt;
Forwarding to the Allegro Network Multimeter uses the configured server name. In this example, requests to &#039;&#039;&#039;allegro-mm-1234.mm-remote.company.com&#039;&#039;&#039; will be forwarded to the Multimeter.&lt;br /&gt;
This requires that the hostname is resolved by the DNS server. This can be solved by a wildcard DNS CNAME entry to point at the SSH server.&lt;br /&gt;
&lt;br /&gt;
=== Configuration of the Multimeter ===&lt;br /&gt;
&lt;br /&gt;
In the configuration dialogue, insert the parameters to access the SSH server. For example:&lt;br /&gt;
&lt;br /&gt;
* SSH Host: &#039;&#039;&#039;mm-remote.company.com&#039;&#039;&#039;&lt;br /&gt;
* SSH Port: &#039;&#039;&#039;22&#039;&#039;&#039;&lt;br /&gt;
* SSH User: &#039;&#039;&#039;mmremote&#039;&#039;&#039;&lt;br /&gt;
* Listening HTTPS Port on SSH Host: &#039;&#039;&#039;55443&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
The settings have to match the above configuration. &#039;&#039;&#039;Every Multimeter requires a separate HTTPS listening port..&#039;&#039;&#039;&lt;br /&gt;
If the &#039;&#039;&#039;SSH user&#039;&#039;&#039; is not &#039;&#039;&#039;root, no port below 1024&#039;&#039;&#039; is possible. Otherwise, an error message will appear when trying to connect.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=FAQ&amp;diff=2824</id>
		<title>FAQ</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=FAQ&amp;diff=2824"/>
		<updated>2020-05-14T13:13:53Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* How can I print statistics? */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Setup == &lt;br /&gt;
==== What is the difference between the Monitor interfaces and the Management interfaces? ==== &lt;br /&gt;
&lt;br /&gt;
The Monitor interfaces are used to passively analyze traffic and cannot be used for management functions such as accessing&lt;br /&gt;
the user interface. These interfaces do not generate any traffic apart from forwarding traffic received on the adjacent&lt;br /&gt;
interface if configured to Bridge mode.&lt;br /&gt;
The Management interface on the other hand, is dedicated for management functions like accessing the user interface,&lt;br /&gt;
downloading and uploading pcaps, streaming captured data to the device for analysis and so on. The Management&lt;br /&gt;
interface actively participates in the network it is connected to.&lt;br /&gt;
&lt;br /&gt;
==== How can I monitor the traffic of a single computer? ====&lt;br /&gt;
&lt;br /&gt;
The easiest way of monitoring and analyzing the traffic of a single device like a computer is to configure the&lt;br /&gt;
Allegro Network Multimeter in Bridge mode. The device to be monitored is connected to one interface of a bridged pair&lt;br /&gt;
of interfaces on the Allegro Network Multimeter. The other interface of the bridged pair is connected to the&lt;br /&gt;
network to which the device would normally be directly connected.&lt;br /&gt;
&lt;br /&gt;
In a setup like this, the Allegro Network Multimeter transparently forwards traffic between the device and the&lt;br /&gt;
network while providing full insight into the traffic between the device and the network.&lt;br /&gt;
&lt;br /&gt;
==== What is the difference between Bridge mode and Sink mode? ====&lt;br /&gt;
&lt;br /&gt;
If the Allegro Network Multimeter is configured to Sink mode, all Monitor interfaces act in a similar way in that they &lt;br /&gt;
receive traffic which is then analyzed by the appliance but not forwarded. The appliance acts as a traffic&lt;br /&gt;
sink, as it receives packets, analyzes them and discards them. This mode is ideally suited for situations&lt;br /&gt;
where traffic is already a copy; for example, on a Mirror Port of a Switch or on a network traffic Tap.&lt;br /&gt;
&lt;br /&gt;
If configured in Bridge mode, the Allegro Network Multimeter transparently forwards all traffic between adjacent Monitor&lt;br /&gt;
interfaces while simultaneously analyzing the forwarded traffic. The appliance acts as a network Bridge and can &lt;br /&gt;
be connected between two network devices which would normally be connected directly to each other. This mode&lt;br /&gt;
is suited for inserting the Allegro Network Multimeter directly into a point of the network without the need of a separate network&lt;br /&gt;
Tap or other means of providing a copy of the network traffic.&lt;br /&gt;
&lt;br /&gt;
==== I have used the LAN Management interface but I do not know the leased IP. How can I get the assigned IP address? ====&lt;br /&gt;
&lt;br /&gt;
===== DHCP server =====&lt;br /&gt;
&lt;br /&gt;
If the selected DHCP server provides some kind of log output or an overview of devices for which IP address leases have&lt;br /&gt;
been granted, it might help to search for a device with a hostname that starts with &#039;&#039;&#039;allegro-mm-&#039;&#039;&#039; followed by a four&lt;br /&gt;
digit hexadecimal number. The Allegro Network Multimeter announces itself with this hostname when it requests a&lt;br /&gt;
DHCP lease and should be traceable in the DHCP server info.&lt;br /&gt;
&lt;br /&gt;
===== WI-FI =====&lt;br /&gt;
&lt;br /&gt;
Every Allegro Network Multimeter comes with an USB to Wi-Fi adapter. In the factory default configuration the adapter will&lt;br /&gt;
create a wi-Fi Access Point when connected to the appliance. This Access Point shows up as &#039;&#039;&#039;allegro-mm-xxxx&#039;&#039;&#039; where the&lt;br /&gt;
&#039;&#039;&#039;xxxx&#039;&#039;&#039; part consists of a hexadecimal number which is unique to the device. In factory default settings the password&lt;br /&gt;
for the Wi-Fi network is &#039;&#039;&#039;Allegro-MM&#039;&#039;&#039; (without the quotes). As soon as there is a connection to Wi-Fi, the user&lt;br /&gt;
interface of the device can be accessed by either browsing to https://allegro or https://192.168.4.1.&lt;br /&gt;
When access to the user interface is established, the IP address of the LAN Management interface can be found under&lt;br /&gt;
&#039;&#039;&#039;Settings&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;Management interface settings&#039;&#039;&#039; in the &#039;&#039;&#039;Active interfaces&#039;&#039;&#039; section.&lt;br /&gt;
&lt;br /&gt;
===== Display =====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter 200 comes with a HDMI connector and&lt;br /&gt;
the 1000 and 3000 series come with a VGA connector.  When a compatible&lt;br /&gt;
display is connected, the console displays information about the running&lt;br /&gt;
Firmware version along with information on the configured&lt;br /&gt;
management network IP addresses. On the 200 model the&lt;br /&gt;
display must be connected before starting the appliance to obtain the output.&lt;br /&gt;
&lt;br /&gt;
===== KVM =====&lt;br /&gt;
&lt;br /&gt;
The video output of the device displaying the management IP addresses can be viewed over the network using the [[IPMI KVM on Allegro series 1000+|KVM/IPMI management module of the 1000 or 3000 series]]. Please see the FAQ entry &#039;&#039;&#039;What can I do with the integrated KVM port?&#039;&#039;&#039; on how to get started.&lt;br /&gt;
&lt;br /&gt;
==== What can I do with the integrated KVM port? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter 1000 and 3000 series devices contain a KVM/IPMI management module from Supermicro by&lt;br /&gt;
which several hardware management functions like powering the device on and off, system health messages and much&lt;br /&gt;
more can be accessed. It is also possible to view the video output of the device over the network from which the&lt;br /&gt;
current active management IP addresses can be retrieved.&lt;br /&gt;
&lt;br /&gt;
By default the KVM/IPMI management module will obtain an IP address through DHCP and the default user name as well&lt;br /&gt;
as default password is &#039;&#039;&#039;ADMIN&#039;&#039;&#039; (without the quotes).&lt;br /&gt;
&lt;br /&gt;
See [[IPMI KVM on Allegro series 1000+]] for additional information.&lt;br /&gt;
&lt;br /&gt;
==== I do not have a Wi-Fi client and I do not have a DHCP server. How can I access the Allegro Network Multimeter? ==== &lt;br /&gt;
&lt;br /&gt;
It is possible to make the Allegro Network Multimeter set a temporary static address on the LAN management interface.&lt;br /&gt;
It will return to the configured behaviour for the LAN management interface following the next restart.&lt;br /&gt;
&lt;br /&gt;
To enable the temporary static IP address, a USB keyboard is needed. When the keyboard is attached to one of the USB&lt;br /&gt;
ports of the Allegro, start the device. Wait for two minutes to make sure that the device is fully operational.&lt;br /&gt;
Then press and hold the &#039;&#039;&#039;shift&#039;&#039;&#039; key while pressing the &#039;&#039;&#039;s&#039;&#039;&#039; key. After this procedure the device will be configured to&lt;br /&gt;
use the IP address &#039;&#039;&#039;192.168.0.1&#039;&#039;&#039; on the LAN management interface. It is now possible to e.g. connect another&lt;br /&gt;
computer to the LAN management interface with an IP address statically configured to e.g. &#039;&#039;&#039;192.168.0.100&#039;&#039;&#039; and from&lt;br /&gt;
that computer the user interface of the Allegro is accessible at https://192.168.0.1.&lt;br /&gt;
If for some reason the IP address &#039;&#039;&#039;192.168.0.1&#039;&#039;&#039; is already used in the network, the Allegro will try to&lt;br /&gt;
set another IP address in the range of &#039;&#039;&#039;192.168.0.2&#039;&#039;&#039; - &#039;&#039;&#039;192.168.0.10&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
Once access to the user interface is established, a static IP address can be configured under &#039;&#039;&#039;Settings&#039;&#039;&#039; -&amp;gt;&lt;br /&gt;
&#039;&#039;&#039;Management interface settings&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
==  Data protection ==&lt;br /&gt;
&lt;br /&gt;
==== What kind of user data is stored on the Allegro Network Multimeter ====&lt;br /&gt;
&lt;br /&gt;
All metadata and statistics are stored in the device&#039;s main memory and are deleted as soon as the device is rebooted,&lt;br /&gt;
powered off, or packet processing is restarted. Any user data that can be derived from these statistics is therefore&lt;br /&gt;
only stored for the duration of continuous operation. If, however, reports are generated and stored on the device, these&lt;br /&gt;
reports exist until manually deleted or until a device configuration reset is performed.&lt;br /&gt;
&lt;br /&gt;
Raw packet data in the packet ring buffer or in stored pcap capture files will persist on the internal or external&lt;br /&gt;
storage until overwritten or deleted. If it is important that captured or deleted data must not be retrieved by someone&lt;br /&gt;
with physical access to the storage devices, it is possible to format the storage device with industry-standard full&lt;br /&gt;
disk encryption.&lt;br /&gt;
&lt;br /&gt;
==== How can I reset the Allegro Network Multimeter to a default configuration? ====&lt;br /&gt;
&lt;br /&gt;
There are two ways to reset the configuration of the appliance.&lt;br /&gt;
&lt;br /&gt;
The first option is to use the &#039;&#039;&#039;Reset System Configuration&#039;&#039;&#039; button which can be found under &#039;&#039;&#039;Settings&#039;&#039;&#039; -&amp;gt;&lt;br /&gt;
&#039;&#039;&#039;Administration&#039;&#039;&#039; in the user interface. After confirmation, this will trigger a restart of the system and afterward the&lt;br /&gt;
appliance will revert to the factory default settings.&lt;br /&gt;
&lt;br /&gt;
If, for some reason, the user interface is not accessible, a configuration reset can be performed by attaching&lt;br /&gt;
a USB keyboard and a HDMI/VGA display to the appliance. When booting the device, there is a short period when a GNU GRUB&lt;br /&gt;
menu is displayed. The arrow up and arrow down keys can be used to select an entry and the selected entry can be chosen&lt;br /&gt;
by pressing the &#039;&#039;&#039;enter&#039;&#039;&#039; key. Below the default &#039;&#039;&#039;multimeter&#039;&#039;&#039; entry, there is a &#039;&#039;&#039;configuration-reset&#039;&#039;&#039; option which will&lt;br /&gt;
perform a reset to default configuration and then reboot the appliance.&lt;br /&gt;
&lt;br /&gt;
Keep in mind that a reset to the default configuration does not delete any&lt;br /&gt;
packet ring buffer data or captured files from internal or external&lt;br /&gt;
storage.&lt;br /&gt;
&lt;br /&gt;
==  System behaviour ==&lt;br /&gt;
&lt;br /&gt;
==== Where does the Allegro Network Multimeter display L1 issues like bad CRC frames? ====&lt;br /&gt;
&lt;br /&gt;
Issues like these are accounted for the Monitoring interface on which the issue was encountered and the respective&lt;br /&gt;
statistics are available on the &#039;&#039;&#039;Interface stats&#039;&#039;&#039; page in the &#039;&#039;&#039;Errors&#039;&#039;&#039; column. For an explanation of the error&lt;br /&gt;
counters, refer to the [[Interface_statistics|Interface statistics]] manual page.&lt;br /&gt;
&lt;br /&gt;
==== What happens in the case of a system overload? ====&lt;br /&gt;
&lt;br /&gt;
In the case of a system overload, a prominent warning is displayed at the top of the user interface for a few seconds&lt;br /&gt;
and this warning and the time when the error occurred can be reviewed on the &#039;&#039;&#039;Info&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;Status&#039;&#039;&#039; page. As long as there are&lt;br /&gt;
still notifications on the &#039;&#039;&#039;Info&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;Status&#039;&#039;&#039; page, this is indicated by coloured icons at the top of the user interface.&lt;br /&gt;
&lt;br /&gt;
If a system overload occurs and not all packets can be analyzed, these packets are accounted at the Monitoring&lt;br /&gt;
interface on which they were received. The counter can be found on the &#039;&#039;&#039;Interface stats&#039;&#039;&#039; page in the &#039;&#039;&#039;Errors&#039;&#039;&#039; column&lt;br /&gt;
under the &#039;&#039;&#039;Not processed&#039;&#039;&#039; section and titled &#039;&#039;&#039;due to overload&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
When the Allegro Network Multimeter is operating in Bridge mode and packets cannot be processed due to a system&lt;br /&gt;
overload, a software bypass will ensure that these packets are still forwarded to the adjacent Monitoring interface.&lt;br /&gt;
&lt;br /&gt;
==== What happens if the maximum number of stored connections has been reached? ====&lt;br /&gt;
&lt;br /&gt;
In this case, the Allegro Network Multimeter will start freeing up memory by removing historic statistical data which&lt;br /&gt;
lies before a certain point in time. This cut-off time is constantly adjusted to provide the best possible use of the&lt;br /&gt;
available memory. For how far back-in-time historical statistics are currently available, can be reviewed on the&lt;br /&gt;
&#039;&#039;&#039;Info&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;System Info&#039;&#039;&#039; page.&lt;br /&gt;
&lt;br /&gt;
==== I can only see the traffic of the last day. How can I increase this period? ====&lt;br /&gt;
&lt;br /&gt;
If the system does not provide a sufficient look back-in-time with the given traffic, it may help to deactivate certain&lt;br /&gt;
features that provide very detailed information but also consume a large amount of memory. Features that typically&lt;br /&gt;
fit into this category are different settings of the &#039;&#039;&#039;IP statistics&#039;&#039;&#039;. These settings can be accessed by navigating to&lt;br /&gt;
&#039;&#039;&#039;IP&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;IP Statistics&#039;&#039;&#039; and clicking the &#039;&#039;&#039;Settings&#039;&#039;&#039; button at the top of the page. Especially turning off the&lt;br /&gt;
&#039;&#039;&#039;Store connection information for every IP&#039;&#039;&#039; and &#039;&#039;&#039;Store traffic history graph for IP peers&#039;&#039;&#039; settings can help saving&lt;br /&gt;
a lot of memory.&lt;br /&gt;
&lt;br /&gt;
==== What happens to the data after shutdown, reboot, or restart processing? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter uses an In-Memory database to store the&lt;br /&gt;
metadata of the packets it processes. This metadata will be lost when the&lt;br /&gt;
processing is stopped (shutdown, reboot, restart processing). This metadata&lt;br /&gt;
is also lost in case of an unexpected power loss.&lt;br /&gt;
&lt;br /&gt;
When using a packet ring buffer (see  [[Storage|storage]]), the packets will be&lt;br /&gt;
stored on the attached hard disk drive. This data is not lost after the&lt;br /&gt;
processing is stopped. It is possible to reanalyze the packet ringbuffer, but&lt;br /&gt;
this will interrupt the &#039;&#039;&#039;live&#039;&#039;&#039; mode, so no new packets will be processed when this is in operation.&lt;br /&gt;
&lt;br /&gt;
==  Allegro hardware ==&lt;br /&gt;
&lt;br /&gt;
==== What types of SFP modules are supported? ====&lt;br /&gt;
&lt;br /&gt;
See [[List_of_Supported_Transceiver_Modules|List of supported transceiver modules]] for details.&lt;br /&gt;
&lt;br /&gt;
==  Bypass ==&lt;br /&gt;
&lt;br /&gt;
==== What bypass options are available? ====&lt;br /&gt;
&lt;br /&gt;
Two bypass options are available:&lt;br /&gt;
&lt;br /&gt;
* a quad-port RJ45 1Gbps copper option supporting 1000BaseT and 100BaseT speeds. Each pair of interfaces makes up a bridged link with bypass.&lt;br /&gt;
* a dual-port 10Gbps fiber option with builtin SR transceivers and LC connectors. The two interfaces make up a bridged link with bypass.&lt;br /&gt;
&lt;br /&gt;
==== How does the bypass work? ====&lt;br /&gt;
&lt;br /&gt;
If the Allegro Network Multimeter contains a bypass option, it is only active when the device is configured to operate&lt;br /&gt;
in Bridge mode. The bypass activates when the device is powered off, when the device is starting but is not yet&lt;br /&gt;
processing traffic or when an unexpected failure like a crash or a power loss occurs. If the bypass is active, the&lt;br /&gt;
two interfaces that make up a bypass link will be physically connected to each other so that devices connected on&lt;br /&gt;
either side will always find a working link.&lt;br /&gt;
&lt;br /&gt;
If the device is operating in Sink mode, the bypass interfaces will act just like all the other interfaces on the device&lt;br /&gt;
and the bypass will never be activated.&lt;br /&gt;
&lt;br /&gt;
==  User interface ==&lt;br /&gt;
&lt;br /&gt;
==== What does the question mark on packets/bytes counters mean? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter stores historical traffic data in&lt;br /&gt;
different time resolutions depending on the age of the data.&lt;br /&gt;
&lt;br /&gt;
When zooming into a specific time window, packet and byte counters are&lt;br /&gt;
shown for this specific time interval only. Since the time resolution&lt;br /&gt;
available internally might be coarser than the selected zoom level,&lt;br /&gt;
the shown packet and byte values might not exactly represent the time&lt;br /&gt;
interval.&lt;br /&gt;
&lt;br /&gt;
If this is the case, the actual interval time is shown in square&lt;br /&gt;
brackets (for example [120s]). This means that the value represents&lt;br /&gt;
the time between the end of the selected interval (the right end of&lt;br /&gt;
the graph) and the shown number of seconds in the past.&lt;br /&gt;
&lt;br /&gt;
This value is shown to avoid confusion about unexpected values due to&lt;br /&gt;
interactive graph zooming.&lt;br /&gt;
&lt;br /&gt;
==== How can I print statistics? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter web interface can be printed by using&lt;br /&gt;
the built-in printing support of your browser. Navigate to the desired&lt;br /&gt;
statistics and click on the printing button (Ctrl+P in most browsers). The pages&lt;br /&gt;
are optimized for printing. Tabs, pcap and navigation buttons are hidden in&lt;br /&gt;
print mode.&lt;br /&gt;
&lt;br /&gt;
If the browser is truncating the page in print preview, you can try the&lt;br /&gt;
&#039;&#039;&#039;Shrink to fit&#039;&#039;&#039; option (Firefox) or use a smaller scaling than 100% (Chrome).&lt;br /&gt;
You can also use another page orientation and change between &#039;&#039;&#039;landscape&#039;&#039;&#039; or &#039;&#039;&#039;portrait&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
==  Packet ring buffer ==&lt;br /&gt;
&lt;br /&gt;
==== Which time stamps are used during packet ring buffer replay? ==== &lt;br /&gt;
&lt;br /&gt;
Packet ring buffer replay will use the original time stamps of the packets as they were captured. Therefore the replay&lt;br /&gt;
recreates the original sequence and timing of packets in the displayed statistics.&lt;br /&gt;
&lt;br /&gt;
==  Capturing ==&lt;br /&gt;
&lt;br /&gt;
==== How many captures can be used in parallel? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter 200 supports up to 3 parallel and the&lt;br /&gt;
1000/3000 model supports up to 4 parallel captures. If the memory&lt;br /&gt;
usage is too high, the number of parallel captures might be lower.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=FAQ&amp;diff=2823</id>
		<title>FAQ</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=FAQ&amp;diff=2823"/>
		<updated>2020-05-14T13:12:25Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* How does the bypass work? */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Setup == &lt;br /&gt;
==== What is the difference between the Monitor interfaces and the Management interfaces? ==== &lt;br /&gt;
&lt;br /&gt;
The Monitor interfaces are used to passively analyze traffic and cannot be used for management functions such as accessing&lt;br /&gt;
the user interface. These interfaces do not generate any traffic apart from forwarding traffic received on the adjacent&lt;br /&gt;
interface if configured to Bridge mode.&lt;br /&gt;
The Management interface on the other hand, is dedicated for management functions like accessing the user interface,&lt;br /&gt;
downloading and uploading pcaps, streaming captured data to the device for analysis and so on. The Management&lt;br /&gt;
interface actively participates in the network it is connected to.&lt;br /&gt;
&lt;br /&gt;
==== How can I monitor the traffic of a single computer? ====&lt;br /&gt;
&lt;br /&gt;
The easiest way of monitoring and analyzing the traffic of a single device like a computer is to configure the&lt;br /&gt;
Allegro Network Multimeter in Bridge mode. The device to be monitored is connected to one interface of a bridged pair&lt;br /&gt;
of interfaces on the Allegro Network Multimeter. The other interface of the bridged pair is connected to the&lt;br /&gt;
network to which the device would normally be directly connected.&lt;br /&gt;
&lt;br /&gt;
In a setup like this, the Allegro Network Multimeter transparently forwards traffic between the device and the&lt;br /&gt;
network while providing full insight into the traffic between the device and the network.&lt;br /&gt;
&lt;br /&gt;
==== What is the difference between Bridge mode and Sink mode? ====&lt;br /&gt;
&lt;br /&gt;
If the Allegro Network Multimeter is configured to Sink mode, all Monitor interfaces act in a similar way in that they &lt;br /&gt;
receive traffic which is then analyzed by the appliance but not forwarded. The appliance acts as a traffic&lt;br /&gt;
sink, as it receives packets, analyzes them and discards them. This mode is ideally suited for situations&lt;br /&gt;
where traffic is already a copy; for example, on a Mirror Port of a Switch or on a network traffic Tap.&lt;br /&gt;
&lt;br /&gt;
If configured in Bridge mode, the Allegro Network Multimeter transparently forwards all traffic between adjacent Monitor&lt;br /&gt;
interfaces while simultaneously analyzing the forwarded traffic. The appliance acts as a network Bridge and can &lt;br /&gt;
be connected between two network devices which would normally be connected directly to each other. This mode&lt;br /&gt;
is suited for inserting the Allegro Network Multimeter directly into a point of the network without the need of a separate network&lt;br /&gt;
Tap or other means of providing a copy of the network traffic.&lt;br /&gt;
&lt;br /&gt;
==== I have used the LAN Management interface but I do not know the leased IP. How can I get the assigned IP address? ====&lt;br /&gt;
&lt;br /&gt;
===== DHCP server =====&lt;br /&gt;
&lt;br /&gt;
If the selected DHCP server provides some kind of log output or an overview of devices for which IP address leases have&lt;br /&gt;
been granted, it might help to search for a device with a hostname that starts with &#039;&#039;&#039;allegro-mm-&#039;&#039;&#039; followed by a four&lt;br /&gt;
digit hexadecimal number. The Allegro Network Multimeter announces itself with this hostname when it requests a&lt;br /&gt;
DHCP lease and should be traceable in the DHCP server info.&lt;br /&gt;
&lt;br /&gt;
===== WI-FI =====&lt;br /&gt;
&lt;br /&gt;
Every Allegro Network Multimeter comes with an USB to Wi-Fi adapter. In the factory default configuration the adapter will&lt;br /&gt;
create a wi-Fi Access Point when connected to the appliance. This Access Point shows up as &#039;&#039;&#039;allegro-mm-xxxx&#039;&#039;&#039; where the&lt;br /&gt;
&#039;&#039;&#039;xxxx&#039;&#039;&#039; part consists of a hexadecimal number which is unique to the device. In factory default settings the password&lt;br /&gt;
for the Wi-Fi network is &#039;&#039;&#039;Allegro-MM&#039;&#039;&#039; (without the quotes). As soon as there is a connection to Wi-Fi, the user&lt;br /&gt;
interface of the device can be accessed by either browsing to https://allegro or https://192.168.4.1.&lt;br /&gt;
When access to the user interface is established, the IP address of the LAN Management interface can be found under&lt;br /&gt;
&#039;&#039;&#039;Settings&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;Management interface settings&#039;&#039;&#039; in the &#039;&#039;&#039;Active interfaces&#039;&#039;&#039; section.&lt;br /&gt;
&lt;br /&gt;
===== Display =====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter 200 comes with a HDMI connector and&lt;br /&gt;
the 1000 and 3000 series come with a VGA connector.  When a compatible&lt;br /&gt;
display is connected, the console displays information about the running&lt;br /&gt;
Firmware version along with information on the configured&lt;br /&gt;
management network IP addresses. On the 200 model the&lt;br /&gt;
display must be connected before starting the appliance to obtain the output.&lt;br /&gt;
&lt;br /&gt;
===== KVM =====&lt;br /&gt;
&lt;br /&gt;
The video output of the device displaying the management IP addresses can be viewed over the network using the [[IPMI KVM on Allegro series 1000+|KVM/IPMI management module of the 1000 or 3000 series]]. Please see the FAQ entry &#039;&#039;&#039;What can I do with the integrated KVM port?&#039;&#039;&#039; on how to get started.&lt;br /&gt;
&lt;br /&gt;
==== What can I do with the integrated KVM port? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter 1000 and 3000 series devices contain a KVM/IPMI management module from Supermicro by&lt;br /&gt;
which several hardware management functions like powering the device on and off, system health messages and much&lt;br /&gt;
more can be accessed. It is also possible to view the video output of the device over the network from which the&lt;br /&gt;
current active management IP addresses can be retrieved.&lt;br /&gt;
&lt;br /&gt;
By default the KVM/IPMI management module will obtain an IP address through DHCP and the default user name as well&lt;br /&gt;
as default password is &#039;&#039;&#039;ADMIN&#039;&#039;&#039; (without the quotes).&lt;br /&gt;
&lt;br /&gt;
See [[IPMI KVM on Allegro series 1000+]] for additional information.&lt;br /&gt;
&lt;br /&gt;
==== I do not have a Wi-Fi client and I do not have a DHCP server. How can I access the Allegro Network Multimeter? ==== &lt;br /&gt;
&lt;br /&gt;
It is possible to make the Allegro Network Multimeter set a temporary static address on the LAN management interface.&lt;br /&gt;
It will return to the configured behaviour for the LAN management interface following the next restart.&lt;br /&gt;
&lt;br /&gt;
To enable the temporary static IP address, a USB keyboard is needed. When the keyboard is attached to one of the USB&lt;br /&gt;
ports of the Allegro, start the device. Wait for two minutes to make sure that the device is fully operational.&lt;br /&gt;
Then press and hold the &#039;&#039;&#039;shift&#039;&#039;&#039; key while pressing the &#039;&#039;&#039;s&#039;&#039;&#039; key. After this procedure the device will be configured to&lt;br /&gt;
use the IP address &#039;&#039;&#039;192.168.0.1&#039;&#039;&#039; on the LAN management interface. It is now possible to e.g. connect another&lt;br /&gt;
computer to the LAN management interface with an IP address statically configured to e.g. &#039;&#039;&#039;192.168.0.100&#039;&#039;&#039; and from&lt;br /&gt;
that computer the user interface of the Allegro is accessible at https://192.168.0.1.&lt;br /&gt;
If for some reason the IP address &#039;&#039;&#039;192.168.0.1&#039;&#039;&#039; is already used in the network, the Allegro will try to&lt;br /&gt;
set another IP address in the range of &#039;&#039;&#039;192.168.0.2&#039;&#039;&#039; - &#039;&#039;&#039;192.168.0.10&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
Once access to the user interface is established, a static IP address can be configured under &#039;&#039;&#039;Settings&#039;&#039;&#039; -&amp;gt;&lt;br /&gt;
&#039;&#039;&#039;Management interface settings&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
==  Data protection ==&lt;br /&gt;
&lt;br /&gt;
==== What kind of user data is stored on the Allegro Network Multimeter ====&lt;br /&gt;
&lt;br /&gt;
All metadata and statistics are stored in the device&#039;s main memory and are deleted as soon as the device is rebooted,&lt;br /&gt;
powered off, or packet processing is restarted. Any user data that can be derived from these statistics is therefore&lt;br /&gt;
only stored for the duration of continuous operation. If, however, reports are generated and stored on the device, these&lt;br /&gt;
reports exist until manually deleted or until a device configuration reset is performed.&lt;br /&gt;
&lt;br /&gt;
Raw packet data in the packet ring buffer or in stored pcap capture files will persist on the internal or external&lt;br /&gt;
storage until overwritten or deleted. If it is important that captured or deleted data must not be retrieved by someone&lt;br /&gt;
with physical access to the storage devices, it is possible to format the storage device with industry-standard full&lt;br /&gt;
disk encryption.&lt;br /&gt;
&lt;br /&gt;
==== How can I reset the Allegro Network Multimeter to a default configuration? ====&lt;br /&gt;
&lt;br /&gt;
There are two ways to reset the configuration of the appliance.&lt;br /&gt;
&lt;br /&gt;
The first option is to use the &#039;&#039;&#039;Reset System Configuration&#039;&#039;&#039; button which can be found under &#039;&#039;&#039;Settings&#039;&#039;&#039; -&amp;gt;&lt;br /&gt;
&#039;&#039;&#039;Administration&#039;&#039;&#039; in the user interface. After confirmation, this will trigger a restart of the system and afterward the&lt;br /&gt;
appliance will revert to the factory default settings.&lt;br /&gt;
&lt;br /&gt;
If, for some reason, the user interface is not accessible, a configuration reset can be performed by attaching&lt;br /&gt;
a USB keyboard and a HDMI/VGA display to the appliance. When booting the device, there is a short period when a GNU GRUB&lt;br /&gt;
menu is displayed. The arrow up and arrow down keys can be used to select an entry and the selected entry can be chosen&lt;br /&gt;
by pressing the &#039;&#039;&#039;enter&#039;&#039;&#039; key. Below the default &#039;&#039;&#039;multimeter&#039;&#039;&#039; entry, there is a &#039;&#039;&#039;configuration-reset&#039;&#039;&#039; option which will&lt;br /&gt;
perform a reset to default configuration and then reboot the appliance.&lt;br /&gt;
&lt;br /&gt;
Keep in mind that a reset to the default configuration does not delete any&lt;br /&gt;
packet ring buffer data or captured files from internal or external&lt;br /&gt;
storage.&lt;br /&gt;
&lt;br /&gt;
==  System behaviour ==&lt;br /&gt;
&lt;br /&gt;
==== Where does the Allegro Network Multimeter display L1 issues like bad CRC frames? ====&lt;br /&gt;
&lt;br /&gt;
Issues like these are accounted for the Monitoring interface on which the issue was encountered and the respective&lt;br /&gt;
statistics are available on the &#039;&#039;&#039;Interface stats&#039;&#039;&#039; page in the &#039;&#039;&#039;Errors&#039;&#039;&#039; column. For an explanation of the error&lt;br /&gt;
counters, refer to the [[Interface_statistics|Interface statistics]] manual page.&lt;br /&gt;
&lt;br /&gt;
==== What happens in the case of a system overload? ====&lt;br /&gt;
&lt;br /&gt;
In the case of a system overload, a prominent warning is displayed at the top of the user interface for a few seconds&lt;br /&gt;
and this warning and the time when the error occurred can be reviewed on the &#039;&#039;&#039;Info&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;Status&#039;&#039;&#039; page. As long as there are&lt;br /&gt;
still notifications on the &#039;&#039;&#039;Info&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;Status&#039;&#039;&#039; page, this is indicated by coloured icons at the top of the user interface.&lt;br /&gt;
&lt;br /&gt;
If a system overload occurs and not all packets can be analyzed, these packets are accounted at the Monitoring&lt;br /&gt;
interface on which they were received. The counter can be found on the &#039;&#039;&#039;Interface stats&#039;&#039;&#039; page in the &#039;&#039;&#039;Errors&#039;&#039;&#039; column&lt;br /&gt;
under the &#039;&#039;&#039;Not processed&#039;&#039;&#039; section and titled &#039;&#039;&#039;due to overload&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
When the Allegro Network Multimeter is operating in Bridge mode and packets cannot be processed due to a system&lt;br /&gt;
overload, a software bypass will ensure that these packets are still forwarded to the adjacent Monitoring interface.&lt;br /&gt;
&lt;br /&gt;
==== What happens if the maximum number of stored connections has been reached? ====&lt;br /&gt;
&lt;br /&gt;
In this case, the Allegro Network Multimeter will start freeing up memory by removing historic statistical data which&lt;br /&gt;
lies before a certain point in time. This cut-off time is constantly adjusted to provide the best possible use of the&lt;br /&gt;
available memory. For how far back-in-time historical statistics are currently available, can be reviewed on the&lt;br /&gt;
&#039;&#039;&#039;Info&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;System Info&#039;&#039;&#039; page.&lt;br /&gt;
&lt;br /&gt;
==== I can only see the traffic of the last day. How can I increase this period? ====&lt;br /&gt;
&lt;br /&gt;
If the system does not provide a sufficient look back-in-time with the given traffic, it may help to deactivate certain&lt;br /&gt;
features that provide very detailed information but also consume a large amount of memory. Features that typically&lt;br /&gt;
fit into this category are different settings of the &#039;&#039;&#039;IP statistics&#039;&#039;&#039;. These settings can be accessed by navigating to&lt;br /&gt;
&#039;&#039;&#039;IP&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;IP Statistics&#039;&#039;&#039; and clicking the &#039;&#039;&#039;Settings&#039;&#039;&#039; button at the top of the page. Especially turning off the&lt;br /&gt;
&#039;&#039;&#039;Store connection information for every IP&#039;&#039;&#039; and &#039;&#039;&#039;Store traffic history graph for IP peers&#039;&#039;&#039; settings can help saving&lt;br /&gt;
a lot of memory.&lt;br /&gt;
&lt;br /&gt;
==== What happens to the data after shutdown, reboot, or restart processing? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter uses an In-Memory database to store the&lt;br /&gt;
metadata of the packets it processes. This metadata will be lost when the&lt;br /&gt;
processing is stopped (shutdown, reboot, restart processing). This metadata&lt;br /&gt;
is also lost in case of an unexpected power loss.&lt;br /&gt;
&lt;br /&gt;
When using a packet ring buffer (see  [[Storage|storage]]), the packets will be&lt;br /&gt;
stored on the attached hard disk drive. This data is not lost after the&lt;br /&gt;
processing is stopped. It is possible to reanalyze the packet ringbuffer, but&lt;br /&gt;
this will interrupt the &#039;&#039;&#039;live&#039;&#039;&#039; mode, so no new packets will be processed when this is in operation.&lt;br /&gt;
&lt;br /&gt;
==  Allegro hardware ==&lt;br /&gt;
&lt;br /&gt;
==== What types of SFP modules are supported? ====&lt;br /&gt;
&lt;br /&gt;
See [[List_of_Supported_Transceiver_Modules|List of supported transceiver modules]] for details.&lt;br /&gt;
&lt;br /&gt;
==  Bypass ==&lt;br /&gt;
&lt;br /&gt;
==== What bypass options are available? ====&lt;br /&gt;
&lt;br /&gt;
Two bypass options are available:&lt;br /&gt;
&lt;br /&gt;
* a quad-port RJ45 1Gbps copper option supporting 1000BaseT and 100BaseT speeds. Each pair of interfaces makes up a bridged link with bypass.&lt;br /&gt;
* a dual-port 10Gbps fiber option with builtin SR transceivers and LC connectors. The two interfaces make up a bridged link with bypass.&lt;br /&gt;
&lt;br /&gt;
==== How does the bypass work? ====&lt;br /&gt;
&lt;br /&gt;
If the Allegro Network Multimeter contains a bypass option, it is only active when the device is configured to operate&lt;br /&gt;
in Bridge mode. The bypass activates when the device is powered off, when the device is starting but is not yet&lt;br /&gt;
processing traffic or when an unexpected failure like a crash or a power loss occurs. If the bypass is active, the&lt;br /&gt;
two interfaces that make up a bypass link will be physically connected to each other so that devices connected on&lt;br /&gt;
either side will always find a working link.&lt;br /&gt;
&lt;br /&gt;
If the device is operating in Sink mode, the bypass interfaces will act just like all the other interfaces on the device&lt;br /&gt;
and the bypass will never be activated.&lt;br /&gt;
&lt;br /&gt;
==  User interface ==&lt;br /&gt;
&lt;br /&gt;
==== What does the question mark on packets/bytes counters mean? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter stores historical traffic data in&lt;br /&gt;
different time resolutions depending on the age of the data.&lt;br /&gt;
&lt;br /&gt;
When zooming into a specific time window, packet and byte counters are&lt;br /&gt;
shown for this specific time interval only. Since the time resolution&lt;br /&gt;
available internally might be coarser than the selected zoom level,&lt;br /&gt;
the shown packet and byte values might not exactly represent the time&lt;br /&gt;
interval.&lt;br /&gt;
&lt;br /&gt;
If this is the case, the actual interval time is shown in square&lt;br /&gt;
brackets (for example [120s]). This means that the value represents&lt;br /&gt;
the time between the end of the selected interval (the right end of&lt;br /&gt;
the graph) and the shown number of seconds in the past.&lt;br /&gt;
&lt;br /&gt;
This value is shown to avoid confusion about unexpected values due to&lt;br /&gt;
interactive graph zooming.&lt;br /&gt;
&lt;br /&gt;
==== How can I print statistics? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter web interface can be printed by using&lt;br /&gt;
the built-in printing support of your browser. Just navigate to the desired&lt;br /&gt;
statistics and click on the printing button (Ctrl+P in most browsers). The pages&lt;br /&gt;
are optimized for printing. Tabs, PCAP and navigation buttons are hidden in&lt;br /&gt;
print mode.&lt;br /&gt;
&lt;br /&gt;
If the browser is truncating the page in print preview, you can try to use&lt;br /&gt;
&#039;&#039;&#039;Shrink to fit&#039;&#039;&#039; option (Firefox) or use a smaller scaling than 100% (Chrome).&lt;br /&gt;
You can also use another page orientation and change between &#039;&#039;&#039;landscape&#039;&#039;&#039; or &#039;&#039;&#039;portrait&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
==  Packet ring buffer ==&lt;br /&gt;
&lt;br /&gt;
==== Which time stamps are used during packet ring buffer replay? ==== &lt;br /&gt;
&lt;br /&gt;
Packet ring buffer replay will use the original time stamps of the packets as they were captured. Therefore the replay&lt;br /&gt;
recreates the original sequence and timing of packets in the displayed statistics.&lt;br /&gt;
&lt;br /&gt;
==  Capturing ==&lt;br /&gt;
&lt;br /&gt;
==== How many captures can be used in parallel? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter 200 supports up to 3 parallel and the&lt;br /&gt;
1000/3000 model supports up to 4 parallel captures. If the memory&lt;br /&gt;
usage is too high, the number of parallel captures might be lower.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=FAQ&amp;diff=2822</id>
		<title>FAQ</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=FAQ&amp;diff=2822"/>
		<updated>2020-05-14T13:11:05Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* System behavior */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Setup == &lt;br /&gt;
==== What is the difference between the Monitor interfaces and the Management interfaces? ==== &lt;br /&gt;
&lt;br /&gt;
The Monitor interfaces are used to passively analyze traffic and cannot be used for management functions such as accessing&lt;br /&gt;
the user interface. These interfaces do not generate any traffic apart from forwarding traffic received on the adjacent&lt;br /&gt;
interface if configured to Bridge mode.&lt;br /&gt;
The Management interface on the other hand, is dedicated for management functions like accessing the user interface,&lt;br /&gt;
downloading and uploading pcaps, streaming captured data to the device for analysis and so on. The Management&lt;br /&gt;
interface actively participates in the network it is connected to.&lt;br /&gt;
&lt;br /&gt;
==== How can I monitor the traffic of a single computer? ====&lt;br /&gt;
&lt;br /&gt;
The easiest way of monitoring and analyzing the traffic of a single device like a computer is to configure the&lt;br /&gt;
Allegro Network Multimeter in Bridge mode. The device to be monitored is connected to one interface of a bridged pair&lt;br /&gt;
of interfaces on the Allegro Network Multimeter. The other interface of the bridged pair is connected to the&lt;br /&gt;
network to which the device would normally be directly connected.&lt;br /&gt;
&lt;br /&gt;
In a setup like this, the Allegro Network Multimeter transparently forwards traffic between the device and the&lt;br /&gt;
network while providing full insight into the traffic between the device and the network.&lt;br /&gt;
&lt;br /&gt;
==== What is the difference between Bridge mode and Sink mode? ====&lt;br /&gt;
&lt;br /&gt;
If the Allegro Network Multimeter is configured to Sink mode, all Monitor interfaces act in a similar way in that they &lt;br /&gt;
receive traffic which is then analyzed by the appliance but not forwarded. The appliance acts as a traffic&lt;br /&gt;
sink, as it receives packets, analyzes them and discards them. This mode is ideally suited for situations&lt;br /&gt;
where traffic is already a copy; for example, on a Mirror Port of a Switch or on a network traffic Tap.&lt;br /&gt;
&lt;br /&gt;
If configured in Bridge mode, the Allegro Network Multimeter transparently forwards all traffic between adjacent Monitor&lt;br /&gt;
interfaces while simultaneously analyzing the forwarded traffic. The appliance acts as a network Bridge and can &lt;br /&gt;
be connected between two network devices which would normally be connected directly to each other. This mode&lt;br /&gt;
is suited for inserting the Allegro Network Multimeter directly into a point of the network without the need of a separate network&lt;br /&gt;
Tap or other means of providing a copy of the network traffic.&lt;br /&gt;
&lt;br /&gt;
==== I have used the LAN Management interface but I do not know the leased IP. How can I get the assigned IP address? ====&lt;br /&gt;
&lt;br /&gt;
===== DHCP server =====&lt;br /&gt;
&lt;br /&gt;
If the selected DHCP server provides some kind of log output or an overview of devices for which IP address leases have&lt;br /&gt;
been granted, it might help to search for a device with a hostname that starts with &#039;&#039;&#039;allegro-mm-&#039;&#039;&#039; followed by a four&lt;br /&gt;
digit hexadecimal number. The Allegro Network Multimeter announces itself with this hostname when it requests a&lt;br /&gt;
DHCP lease and should be traceable in the DHCP server info.&lt;br /&gt;
&lt;br /&gt;
===== WI-FI =====&lt;br /&gt;
&lt;br /&gt;
Every Allegro Network Multimeter comes with an USB to Wi-Fi adapter. In the factory default configuration the adapter will&lt;br /&gt;
create a wi-Fi Access Point when connected to the appliance. This Access Point shows up as &#039;&#039;&#039;allegro-mm-xxxx&#039;&#039;&#039; where the&lt;br /&gt;
&#039;&#039;&#039;xxxx&#039;&#039;&#039; part consists of a hexadecimal number which is unique to the device. In factory default settings the password&lt;br /&gt;
for the Wi-Fi network is &#039;&#039;&#039;Allegro-MM&#039;&#039;&#039; (without the quotes). As soon as there is a connection to Wi-Fi, the user&lt;br /&gt;
interface of the device can be accessed by either browsing to https://allegro or https://192.168.4.1.&lt;br /&gt;
When access to the user interface is established, the IP address of the LAN Management interface can be found under&lt;br /&gt;
&#039;&#039;&#039;Settings&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;Management interface settings&#039;&#039;&#039; in the &#039;&#039;&#039;Active interfaces&#039;&#039;&#039; section.&lt;br /&gt;
&lt;br /&gt;
===== Display =====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter 200 comes with a HDMI connector and&lt;br /&gt;
the 1000 and 3000 series come with a VGA connector.  When a compatible&lt;br /&gt;
display is connected, the console displays information about the running&lt;br /&gt;
Firmware version along with information on the configured&lt;br /&gt;
management network IP addresses. On the 200 model the&lt;br /&gt;
display must be connected before starting the appliance to obtain the output.&lt;br /&gt;
&lt;br /&gt;
===== KVM =====&lt;br /&gt;
&lt;br /&gt;
The video output of the device displaying the management IP addresses can be viewed over the network using the [[IPMI KVM on Allegro series 1000+|KVM/IPMI management module of the 1000 or 3000 series]]. Please see the FAQ entry &#039;&#039;&#039;What can I do with the integrated KVM port?&#039;&#039;&#039; on how to get started.&lt;br /&gt;
&lt;br /&gt;
==== What can I do with the integrated KVM port? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter 1000 and 3000 series devices contain a KVM/IPMI management module from Supermicro by&lt;br /&gt;
which several hardware management functions like powering the device on and off, system health messages and much&lt;br /&gt;
more can be accessed. It is also possible to view the video output of the device over the network from which the&lt;br /&gt;
current active management IP addresses can be retrieved.&lt;br /&gt;
&lt;br /&gt;
By default the KVM/IPMI management module will obtain an IP address through DHCP and the default user name as well&lt;br /&gt;
as default password is &#039;&#039;&#039;ADMIN&#039;&#039;&#039; (without the quotes).&lt;br /&gt;
&lt;br /&gt;
See [[IPMI KVM on Allegro series 1000+]] for additional information.&lt;br /&gt;
&lt;br /&gt;
==== I do not have a Wi-Fi client and I do not have a DHCP server. How can I access the Allegro Network Multimeter? ==== &lt;br /&gt;
&lt;br /&gt;
It is possible to make the Allegro Network Multimeter set a temporary static address on the LAN management interface.&lt;br /&gt;
It will return to the configured behaviour for the LAN management interface following the next restart.&lt;br /&gt;
&lt;br /&gt;
To enable the temporary static IP address, a USB keyboard is needed. When the keyboard is attached to one of the USB&lt;br /&gt;
ports of the Allegro, start the device. Wait for two minutes to make sure that the device is fully operational.&lt;br /&gt;
Then press and hold the &#039;&#039;&#039;shift&#039;&#039;&#039; key while pressing the &#039;&#039;&#039;s&#039;&#039;&#039; key. After this procedure the device will be configured to&lt;br /&gt;
use the IP address &#039;&#039;&#039;192.168.0.1&#039;&#039;&#039; on the LAN management interface. It is now possible to e.g. connect another&lt;br /&gt;
computer to the LAN management interface with an IP address statically configured to e.g. &#039;&#039;&#039;192.168.0.100&#039;&#039;&#039; and from&lt;br /&gt;
that computer the user interface of the Allegro is accessible at https://192.168.0.1.&lt;br /&gt;
If for some reason the IP address &#039;&#039;&#039;192.168.0.1&#039;&#039;&#039; is already used in the network, the Allegro will try to&lt;br /&gt;
set another IP address in the range of &#039;&#039;&#039;192.168.0.2&#039;&#039;&#039; - &#039;&#039;&#039;192.168.0.10&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
Once access to the user interface is established, a static IP address can be configured under &#039;&#039;&#039;Settings&#039;&#039;&#039; -&amp;gt;&lt;br /&gt;
&#039;&#039;&#039;Management interface settings&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
==  Data protection ==&lt;br /&gt;
&lt;br /&gt;
==== What kind of user data is stored on the Allegro Network Multimeter ====&lt;br /&gt;
&lt;br /&gt;
All metadata and statistics are stored in the device&#039;s main memory and are deleted as soon as the device is rebooted,&lt;br /&gt;
powered off, or packet processing is restarted. Any user data that can be derived from these statistics is therefore&lt;br /&gt;
only stored for the duration of continuous operation. If, however, reports are generated and stored on the device, these&lt;br /&gt;
reports exist until manually deleted or until a device configuration reset is performed.&lt;br /&gt;
&lt;br /&gt;
Raw packet data in the packet ring buffer or in stored pcap capture files will persist on the internal or external&lt;br /&gt;
storage until overwritten or deleted. If it is important that captured or deleted data must not be retrieved by someone&lt;br /&gt;
with physical access to the storage devices, it is possible to format the storage device with industry-standard full&lt;br /&gt;
disk encryption.&lt;br /&gt;
&lt;br /&gt;
==== How can I reset the Allegro Network Multimeter to a default configuration? ====&lt;br /&gt;
&lt;br /&gt;
There are two ways to reset the configuration of the appliance.&lt;br /&gt;
&lt;br /&gt;
The first option is to use the &#039;&#039;&#039;Reset System Configuration&#039;&#039;&#039; button which can be found under &#039;&#039;&#039;Settings&#039;&#039;&#039; -&amp;gt;&lt;br /&gt;
&#039;&#039;&#039;Administration&#039;&#039;&#039; in the user interface. After confirmation, this will trigger a restart of the system and afterward the&lt;br /&gt;
appliance will revert to the factory default settings.&lt;br /&gt;
&lt;br /&gt;
If, for some reason, the user interface is not accessible, a configuration reset can be performed by attaching&lt;br /&gt;
a USB keyboard and a HDMI/VGA display to the appliance. When booting the device, there is a short period when a GNU GRUB&lt;br /&gt;
menu is displayed. The arrow up and arrow down keys can be used to select an entry and the selected entry can be chosen&lt;br /&gt;
by pressing the &#039;&#039;&#039;enter&#039;&#039;&#039; key. Below the default &#039;&#039;&#039;multimeter&#039;&#039;&#039; entry, there is a &#039;&#039;&#039;configuration-reset&#039;&#039;&#039; option which will&lt;br /&gt;
perform a reset to default configuration and then reboot the appliance.&lt;br /&gt;
&lt;br /&gt;
Keep in mind that a reset to the default configuration does not delete any&lt;br /&gt;
packet ring buffer data or captured files from internal or external&lt;br /&gt;
storage.&lt;br /&gt;
&lt;br /&gt;
==  System behaviour ==&lt;br /&gt;
&lt;br /&gt;
==== Where does the Allegro Network Multimeter display L1 issues like bad CRC frames? ====&lt;br /&gt;
&lt;br /&gt;
Issues like these are accounted for the Monitoring interface on which the issue was encountered and the respective&lt;br /&gt;
statistics are available on the &#039;&#039;&#039;Interface stats&#039;&#039;&#039; page in the &#039;&#039;&#039;Errors&#039;&#039;&#039; column. For an explanation of the error&lt;br /&gt;
counters, refer to the [[Interface_statistics|Interface statistics]] manual page.&lt;br /&gt;
&lt;br /&gt;
==== What happens in the case of a system overload? ====&lt;br /&gt;
&lt;br /&gt;
In the case of a system overload, a prominent warning is displayed at the top of the user interface for a few seconds&lt;br /&gt;
and this warning and the time when the error occurred can be reviewed on the &#039;&#039;&#039;Info&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;Status&#039;&#039;&#039; page. As long as there are&lt;br /&gt;
still notifications on the &#039;&#039;&#039;Info&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;Status&#039;&#039;&#039; page, this is indicated by coloured icons at the top of the user interface.&lt;br /&gt;
&lt;br /&gt;
If a system overload occurs and not all packets can be analyzed, these packets are accounted at the Monitoring&lt;br /&gt;
interface on which they were received. The counter can be found on the &#039;&#039;&#039;Interface stats&#039;&#039;&#039; page in the &#039;&#039;&#039;Errors&#039;&#039;&#039; column&lt;br /&gt;
under the &#039;&#039;&#039;Not processed&#039;&#039;&#039; section and titled &#039;&#039;&#039;due to overload&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
When the Allegro Network Multimeter is operating in Bridge mode and packets cannot be processed due to a system&lt;br /&gt;
overload, a software bypass will ensure that these packets are still forwarded to the adjacent Monitoring interface.&lt;br /&gt;
&lt;br /&gt;
==== What happens if the maximum number of stored connections has been reached? ====&lt;br /&gt;
&lt;br /&gt;
In this case, the Allegro Network Multimeter will start freeing up memory by removing historic statistical data which&lt;br /&gt;
lies before a certain point in time. This cut-off time is constantly adjusted to provide the best possible use of the&lt;br /&gt;
available memory. For how far back-in-time historical statistics are currently available, can be reviewed on the&lt;br /&gt;
&#039;&#039;&#039;Info&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;System Info&#039;&#039;&#039; page.&lt;br /&gt;
&lt;br /&gt;
==== I can only see the traffic of the last day. How can I increase this period? ====&lt;br /&gt;
&lt;br /&gt;
If the system does not provide a sufficient look back-in-time with the given traffic, it may help to deactivate certain&lt;br /&gt;
features that provide very detailed information but also consume a large amount of memory. Features that typically&lt;br /&gt;
fit into this category are different settings of the &#039;&#039;&#039;IP statistics&#039;&#039;&#039;. These settings can be accessed by navigating to&lt;br /&gt;
&#039;&#039;&#039;IP&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;IP Statistics&#039;&#039;&#039; and clicking the &#039;&#039;&#039;Settings&#039;&#039;&#039; button at the top of the page. Especially turning off the&lt;br /&gt;
&#039;&#039;&#039;Store connection information for every IP&#039;&#039;&#039; and &#039;&#039;&#039;Store traffic history graph for IP peers&#039;&#039;&#039; settings can help saving&lt;br /&gt;
a lot of memory.&lt;br /&gt;
&lt;br /&gt;
==== What happens to the data after shutdown, reboot, or restart processing? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter uses an In-Memory database to store the&lt;br /&gt;
metadata of the packets it processes. This metadata will be lost when the&lt;br /&gt;
processing is stopped (shutdown, reboot, restart processing). This metadata&lt;br /&gt;
is also lost in case of an unexpected power loss.&lt;br /&gt;
&lt;br /&gt;
When using a packet ring buffer (see  [[Storage|storage]]), the packets will be&lt;br /&gt;
stored on the attached hard disk drive. This data is not lost after the&lt;br /&gt;
processing is stopped. It is possible to reanalyze the packet ringbuffer, but&lt;br /&gt;
this will interrupt the &#039;&#039;&#039;live&#039;&#039;&#039; mode, so no new packets will be processed when this is in operation.&lt;br /&gt;
&lt;br /&gt;
==  Allegro hardware ==&lt;br /&gt;
&lt;br /&gt;
==== What types of SFP modules are supported? ====&lt;br /&gt;
&lt;br /&gt;
See [[List_of_Supported_Transceiver_Modules|List of supported transceiver modules]] for details.&lt;br /&gt;
&lt;br /&gt;
==  Bypass ==&lt;br /&gt;
&lt;br /&gt;
==== What bypass options are available? ====&lt;br /&gt;
&lt;br /&gt;
Two bypass options are available:&lt;br /&gt;
&lt;br /&gt;
* a quad-port RJ45 1Gbps copper option supporting 1000BaseT and 100BaseT speeds. Each pair of interfaces makes up a bridged link with bypass.&lt;br /&gt;
* a dual-port 10Gbps fiber option with builtin SR transceivers and LC connectors. The two interfaces make up a bridged link with bypass.&lt;br /&gt;
&lt;br /&gt;
==== How does the bypass work? ====&lt;br /&gt;
&lt;br /&gt;
If the Allegro Network Multimeter contains a bypass option, it is only active when the device is configured to operate&lt;br /&gt;
in bridge mode. The bypass activates when the device is powered off, when the device is starting but is not yet&lt;br /&gt;
processing traffic or when an unexpected failure like a crash or a power loss occurs. If the bypass is active, the&lt;br /&gt;
two interfaces that make up a bypass link will be physically connected to each other so that devices connected on&lt;br /&gt;
either side will always find a working link.&lt;br /&gt;
&lt;br /&gt;
If the device is operating in sink mode, the bypass interfaces will act just like all the other interfaces on the device&lt;br /&gt;
and the bypass will never be activated.&lt;br /&gt;
&lt;br /&gt;
==  User interface ==&lt;br /&gt;
&lt;br /&gt;
==== What does the question mark on packets/bytes counters mean? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter stores historical traffic data in&lt;br /&gt;
different time resolutions depending on the age of the data.&lt;br /&gt;
&lt;br /&gt;
When zooming into a specific time window, packet and byte counters are&lt;br /&gt;
shown for this specific time interval only. Since the time resolution&lt;br /&gt;
available internally might be coarser than the selected zoom level,&lt;br /&gt;
the shown packet and byte values might not exactly represent the time&lt;br /&gt;
interval.&lt;br /&gt;
&lt;br /&gt;
If this is the case, the actual interval time is shown in square&lt;br /&gt;
brackets (for example [120s]). This means that the value represents&lt;br /&gt;
the time between the end of the selected interval (the right end of&lt;br /&gt;
the graph) and the shown number of seconds in the past.&lt;br /&gt;
&lt;br /&gt;
This value is shown to avoid confusion about unexpected values due to&lt;br /&gt;
interactive graph zooming.&lt;br /&gt;
&lt;br /&gt;
==== How can I print statistics? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter web interface can be printed by using&lt;br /&gt;
the built-in printing support of your browser. Just navigate to the desired&lt;br /&gt;
statistics and click on the printing button (Ctrl+P in most browsers). The pages&lt;br /&gt;
are optimized for printing. Tabs, PCAP and navigation buttons are hidden in&lt;br /&gt;
print mode.&lt;br /&gt;
&lt;br /&gt;
If the browser is truncating the page in print preview, you can try to use&lt;br /&gt;
&#039;&#039;&#039;Shrink to fit&#039;&#039;&#039; option (Firefox) or use a smaller scaling than 100% (Chrome).&lt;br /&gt;
You can also use another page orientation and change between &#039;&#039;&#039;landscape&#039;&#039;&#039; or &#039;&#039;&#039;portrait&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
==  Packet ring buffer ==&lt;br /&gt;
&lt;br /&gt;
==== Which time stamps are used during packet ring buffer replay? ==== &lt;br /&gt;
&lt;br /&gt;
Packet ring buffer replay will use the original time stamps of the packets as they were captured. Therefore the replay&lt;br /&gt;
recreates the original sequence and timing of packets in the displayed statistics.&lt;br /&gt;
&lt;br /&gt;
==  Capturing ==&lt;br /&gt;
&lt;br /&gt;
==== How many captures can be used in parallel? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter 200 supports up to 3 parallel and the&lt;br /&gt;
1000/3000 model supports up to 4 parallel captures. If the memory&lt;br /&gt;
usage is too high, the number of parallel captures might be lower.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=FAQ&amp;diff=2821</id>
		<title>FAQ</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=FAQ&amp;diff=2821"/>
		<updated>2020-05-14T13:07:01Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* How can I reset the Allegro Network Multimeter to a default configuration? */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Setup == &lt;br /&gt;
==== What is the difference between the Monitor interfaces and the Management interfaces? ==== &lt;br /&gt;
&lt;br /&gt;
The Monitor interfaces are used to passively analyze traffic and cannot be used for management functions such as accessing&lt;br /&gt;
the user interface. These interfaces do not generate any traffic apart from forwarding traffic received on the adjacent&lt;br /&gt;
interface if configured to Bridge mode.&lt;br /&gt;
The Management interface on the other hand, is dedicated for management functions like accessing the user interface,&lt;br /&gt;
downloading and uploading pcaps, streaming captured data to the device for analysis and so on. The Management&lt;br /&gt;
interface actively participates in the network it is connected to.&lt;br /&gt;
&lt;br /&gt;
==== How can I monitor the traffic of a single computer? ====&lt;br /&gt;
&lt;br /&gt;
The easiest way of monitoring and analyzing the traffic of a single device like a computer is to configure the&lt;br /&gt;
Allegro Network Multimeter in Bridge mode. The device to be monitored is connected to one interface of a bridged pair&lt;br /&gt;
of interfaces on the Allegro Network Multimeter. The other interface of the bridged pair is connected to the&lt;br /&gt;
network to which the device would normally be directly connected.&lt;br /&gt;
&lt;br /&gt;
In a setup like this, the Allegro Network Multimeter transparently forwards traffic between the device and the&lt;br /&gt;
network while providing full insight into the traffic between the device and the network.&lt;br /&gt;
&lt;br /&gt;
==== What is the difference between Bridge mode and Sink mode? ====&lt;br /&gt;
&lt;br /&gt;
If the Allegro Network Multimeter is configured to Sink mode, all Monitor interfaces act in a similar way in that they &lt;br /&gt;
receive traffic which is then analyzed by the appliance but not forwarded. The appliance acts as a traffic&lt;br /&gt;
sink, as it receives packets, analyzes them and discards them. This mode is ideally suited for situations&lt;br /&gt;
where traffic is already a copy; for example, on a Mirror Port of a Switch or on a network traffic Tap.&lt;br /&gt;
&lt;br /&gt;
If configured in Bridge mode, the Allegro Network Multimeter transparently forwards all traffic between adjacent Monitor&lt;br /&gt;
interfaces while simultaneously analyzing the forwarded traffic. The appliance acts as a network Bridge and can &lt;br /&gt;
be connected between two network devices which would normally be connected directly to each other. This mode&lt;br /&gt;
is suited for inserting the Allegro Network Multimeter directly into a point of the network without the need of a separate network&lt;br /&gt;
Tap or other means of providing a copy of the network traffic.&lt;br /&gt;
&lt;br /&gt;
==== I have used the LAN Management interface but I do not know the leased IP. How can I get the assigned IP address? ====&lt;br /&gt;
&lt;br /&gt;
===== DHCP server =====&lt;br /&gt;
&lt;br /&gt;
If the selected DHCP server provides some kind of log output or an overview of devices for which IP address leases have&lt;br /&gt;
been granted, it might help to search for a device with a hostname that starts with &#039;&#039;&#039;allegro-mm-&#039;&#039;&#039; followed by a four&lt;br /&gt;
digit hexadecimal number. The Allegro Network Multimeter announces itself with this hostname when it requests a&lt;br /&gt;
DHCP lease and should be traceable in the DHCP server info.&lt;br /&gt;
&lt;br /&gt;
===== WI-FI =====&lt;br /&gt;
&lt;br /&gt;
Every Allegro Network Multimeter comes with an USB to Wi-Fi adapter. In the factory default configuration the adapter will&lt;br /&gt;
create a wi-Fi Access Point when connected to the appliance. This Access Point shows up as &#039;&#039;&#039;allegro-mm-xxxx&#039;&#039;&#039; where the&lt;br /&gt;
&#039;&#039;&#039;xxxx&#039;&#039;&#039; part consists of a hexadecimal number which is unique to the device. In factory default settings the password&lt;br /&gt;
for the Wi-Fi network is &#039;&#039;&#039;Allegro-MM&#039;&#039;&#039; (without the quotes). As soon as there is a connection to Wi-Fi, the user&lt;br /&gt;
interface of the device can be accessed by either browsing to https://allegro or https://192.168.4.1.&lt;br /&gt;
When access to the user interface is established, the IP address of the LAN Management interface can be found under&lt;br /&gt;
&#039;&#039;&#039;Settings&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;Management interface settings&#039;&#039;&#039; in the &#039;&#039;&#039;Active interfaces&#039;&#039;&#039; section.&lt;br /&gt;
&lt;br /&gt;
===== Display =====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter 200 comes with a HDMI connector and&lt;br /&gt;
the 1000 and 3000 series come with a VGA connector.  When a compatible&lt;br /&gt;
display is connected, the console displays information about the running&lt;br /&gt;
Firmware version along with information on the configured&lt;br /&gt;
management network IP addresses. On the 200 model the&lt;br /&gt;
display must be connected before starting the appliance to obtain the output.&lt;br /&gt;
&lt;br /&gt;
===== KVM =====&lt;br /&gt;
&lt;br /&gt;
The video output of the device displaying the management IP addresses can be viewed over the network using the [[IPMI KVM on Allegro series 1000+|KVM/IPMI management module of the 1000 or 3000 series]]. Please see the FAQ entry &#039;&#039;&#039;What can I do with the integrated KVM port?&#039;&#039;&#039; on how to get started.&lt;br /&gt;
&lt;br /&gt;
==== What can I do with the integrated KVM port? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter 1000 and 3000 series devices contain a KVM/IPMI management module from Supermicro by&lt;br /&gt;
which several hardware management functions like powering the device on and off, system health messages and much&lt;br /&gt;
more can be accessed. It is also possible to view the video output of the device over the network from which the&lt;br /&gt;
current active management IP addresses can be retrieved.&lt;br /&gt;
&lt;br /&gt;
By default the KVM/IPMI management module will obtain an IP address through DHCP and the default user name as well&lt;br /&gt;
as default password is &#039;&#039;&#039;ADMIN&#039;&#039;&#039; (without the quotes).&lt;br /&gt;
&lt;br /&gt;
See [[IPMI KVM on Allegro series 1000+]] for additional information.&lt;br /&gt;
&lt;br /&gt;
==== I do not have a Wi-Fi client and I do not have a DHCP server. How can I access the Allegro Network Multimeter? ==== &lt;br /&gt;
&lt;br /&gt;
It is possible to make the Allegro Network Multimeter set a temporary static address on the LAN management interface.&lt;br /&gt;
It will return to the configured behaviour for the LAN management interface following the next restart.&lt;br /&gt;
&lt;br /&gt;
To enable the temporary static IP address, a USB keyboard is needed. When the keyboard is attached to one of the USB&lt;br /&gt;
ports of the Allegro, start the device. Wait for two minutes to make sure that the device is fully operational.&lt;br /&gt;
Then press and hold the &#039;&#039;&#039;shift&#039;&#039;&#039; key while pressing the &#039;&#039;&#039;s&#039;&#039;&#039; key. After this procedure the device will be configured to&lt;br /&gt;
use the IP address &#039;&#039;&#039;192.168.0.1&#039;&#039;&#039; on the LAN management interface. It is now possible to e.g. connect another&lt;br /&gt;
computer to the LAN management interface with an IP address statically configured to e.g. &#039;&#039;&#039;192.168.0.100&#039;&#039;&#039; and from&lt;br /&gt;
that computer the user interface of the Allegro is accessible at https://192.168.0.1.&lt;br /&gt;
If for some reason the IP address &#039;&#039;&#039;192.168.0.1&#039;&#039;&#039; is already used in the network, the Allegro will try to&lt;br /&gt;
set another IP address in the range of &#039;&#039;&#039;192.168.0.2&#039;&#039;&#039; - &#039;&#039;&#039;192.168.0.10&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
Once access to the user interface is established, a static IP address can be configured under &#039;&#039;&#039;Settings&#039;&#039;&#039; -&amp;gt;&lt;br /&gt;
&#039;&#039;&#039;Management interface settings&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
==  Data protection ==&lt;br /&gt;
&lt;br /&gt;
==== What kind of user data is stored on the Allegro Network Multimeter ====&lt;br /&gt;
&lt;br /&gt;
All metadata and statistics are stored in the device&#039;s main memory and are deleted as soon as the device is rebooted,&lt;br /&gt;
powered off, or packet processing is restarted. Any user data that can be derived from these statistics is therefore&lt;br /&gt;
only stored for the duration of continuous operation. If, however, reports are generated and stored on the device, these&lt;br /&gt;
reports exist until manually deleted or until a device configuration reset is performed.&lt;br /&gt;
&lt;br /&gt;
Raw packet data in the packet ring buffer or in stored pcap capture files will persist on the internal or external&lt;br /&gt;
storage until overwritten or deleted. If it is important that captured or deleted data must not be retrieved by someone&lt;br /&gt;
with physical access to the storage devices, it is possible to format the storage device with industry-standard full&lt;br /&gt;
disk encryption.&lt;br /&gt;
&lt;br /&gt;
==== How can I reset the Allegro Network Multimeter to a default configuration? ====&lt;br /&gt;
&lt;br /&gt;
There are two ways to reset the configuration of the appliance.&lt;br /&gt;
&lt;br /&gt;
The first option is to use the &#039;&#039;&#039;Reset System Configuration&#039;&#039;&#039; button which can be found under &#039;&#039;&#039;Settings&#039;&#039;&#039; -&amp;gt;&lt;br /&gt;
&#039;&#039;&#039;Administration&#039;&#039;&#039; in the user interface. After confirmation, this will trigger a restart of the system and afterward the&lt;br /&gt;
appliance will revert to the factory default settings.&lt;br /&gt;
&lt;br /&gt;
If, for some reason, the user interface is not accessible, a configuration reset can be performed by attaching&lt;br /&gt;
a USB keyboard and a HDMI/VGA display to the appliance. When booting the device, there is a short period when a GNU GRUB&lt;br /&gt;
menu is displayed. The arrow up and arrow down keys can be used to select an entry and the selected entry can be chosen&lt;br /&gt;
by pressing the &#039;&#039;&#039;enter&#039;&#039;&#039; key. Below the default &#039;&#039;&#039;multimeter&#039;&#039;&#039; entry, there is a &#039;&#039;&#039;configuration-reset&#039;&#039;&#039; option which will&lt;br /&gt;
perform a reset to default configuration and then reboot the appliance.&lt;br /&gt;
&lt;br /&gt;
Keep in mind that a reset to the default configuration does not delete any&lt;br /&gt;
packet ring buffer data or captured files from internal or external&lt;br /&gt;
storage.&lt;br /&gt;
&lt;br /&gt;
==  System behavior ==&lt;br /&gt;
&lt;br /&gt;
==== Where does the Allegro Network Multimeter display L1 issues like bad CRC frames? ====&lt;br /&gt;
&lt;br /&gt;
Issues like these are accounted for the Monitoring interface on which the issue was encountered and the respective&lt;br /&gt;
statistics are available on the &#039;&#039;&#039;Interface stats&#039;&#039;&#039; page in the &#039;&#039;&#039;Errors&#039;&#039;&#039; column. For an explanation of the error&lt;br /&gt;
counters, please refer to the [[Interface_statistics|Interface statistics]] manual page.&lt;br /&gt;
&lt;br /&gt;
==== What happens in case of a system overload? ====&lt;br /&gt;
&lt;br /&gt;
In case of a system overload, a prominent warning is displayed at the top of the user interface for a few seconds&lt;br /&gt;
and these warnings and the time when the error occurred can be reviewed on the &#039;&#039;&#039;Info&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;Status&#039;&#039;&#039; page. As long as there are&lt;br /&gt;
still notifications on the &#039;&#039;&#039;Info&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;Status&#039;&#039;&#039; page, this is indicated by colored icons at the top of the user interface.&lt;br /&gt;
&lt;br /&gt;
If a system overload occurs and not all packets can be analyzed, these packets are accounted at the Monitoring&lt;br /&gt;
interface on which they were received. The counter can be found on the &#039;&#039;&#039;Interface stats&#039;&#039;&#039; page in the &#039;&#039;&#039;Errors&#039;&#039;&#039; column&lt;br /&gt;
under the &#039;&#039;&#039;Not processed&#039;&#039;&#039; section and is titled &#039;&#039;&#039;due to overload&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
When the Allegro Network Multimeter is operating in bridge mode and packets cannot be processed due to a system&lt;br /&gt;
overload, a software bypass will ensure that these packets are still forwarded to the adjacent Monitoring interface.&lt;br /&gt;
&lt;br /&gt;
==== What happens if the maximum number of stored connections has been reached? ====&lt;br /&gt;
&lt;br /&gt;
In this case, the Allegro Network Multimeter will start freeing up memory by removing historic statistical data which&lt;br /&gt;
lies before a certain point in time. This cutoff time is constantly adjusted to provide the best possible use of the&lt;br /&gt;
available memory. For how far back-in-time historical statistics are currently available, can be reviewed on the&lt;br /&gt;
&#039;&#039;&#039;Info&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;System Info&#039;&#039;&#039; page.&lt;br /&gt;
&lt;br /&gt;
==== I can only see the traffic of the last day. How can I increase this period? ====&lt;br /&gt;
&lt;br /&gt;
If the system does not provide a sufficient look back-in-time with the given traffic, it may help to deactivate certain&lt;br /&gt;
features that provide very detailed information but also consume a large amount of memory. Features that typically&lt;br /&gt;
fit into this category are the different settings of the &#039;&#039;&#039;IP statistics&#039;&#039;&#039;. These settings can be accessed by navigating to&lt;br /&gt;
&#039;&#039;&#039;IP&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;IP Statistics&#039;&#039;&#039; and clicking the &#039;&#039;&#039;Settings&#039;&#039;&#039; button at the top of the page. Especially turning off the&lt;br /&gt;
&#039;&#039;&#039;Store connection information for every IP&#039;&#039;&#039; and &#039;&#039;&#039;Store traffic history graph for IP peers&#039;&#039;&#039; settings can help saving&lt;br /&gt;
a lot of memory.&lt;br /&gt;
&lt;br /&gt;
==== What happens to the data after shutdown, reboot, or restart processing? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter uses an In-Memory database to store the&lt;br /&gt;
metadata of the packets it processes. This metadata will be lost when the&lt;br /&gt;
processing is stopped (shutdown, reboot, restart processing). This metadata&lt;br /&gt;
is also lost in case of an unexpected power loss.&lt;br /&gt;
&lt;br /&gt;
When using a packet ring buffer (see  [[Storage|storage]]), the packets will be&lt;br /&gt;
stored on the attached hard disk drive. This data is not lost after the&lt;br /&gt;
processing is stopped. It is possible to reanalyze the packet ringbuffer, but&lt;br /&gt;
this will interrupt the &#039;&#039;&#039;live&#039;&#039;&#039; mode, so no new packets will be processed.&lt;br /&gt;
&lt;br /&gt;
==  Allegro hardware ==&lt;br /&gt;
&lt;br /&gt;
==== What types of SFP modules are supported? ====&lt;br /&gt;
&lt;br /&gt;
See [[List_of_Supported_Transceiver_Modules|List of supported transceiver modules]] for details.&lt;br /&gt;
&lt;br /&gt;
==  Bypass ==&lt;br /&gt;
&lt;br /&gt;
==== What bypass options are available? ====&lt;br /&gt;
&lt;br /&gt;
Two bypass options are available:&lt;br /&gt;
&lt;br /&gt;
* a quad-port RJ45 1Gbps copper option supporting 1000BaseT and 100BaseT speeds. Each pair of interfaces makes up a bridged link with bypass.&lt;br /&gt;
* a dual-port 10Gbps fiber option with builtin SR transceivers and LC connectors. The two interfaces make up a bridged link with bypass.&lt;br /&gt;
&lt;br /&gt;
==== How does the bypass work? ====&lt;br /&gt;
&lt;br /&gt;
If the Allegro Network Multimeter contains a bypass option, it is only active when the device is configured to operate&lt;br /&gt;
in bridge mode. The bypass activates when the device is powered off, when the device is starting but is not yet&lt;br /&gt;
processing traffic or when an unexpected failure like a crash or a power loss occurs. If the bypass is active, the&lt;br /&gt;
two interfaces that make up a bypass link will be physically connected to each other so that devices connected on&lt;br /&gt;
either side will always find a working link.&lt;br /&gt;
&lt;br /&gt;
If the device is operating in sink mode, the bypass interfaces will act just like all the other interfaces on the device&lt;br /&gt;
and the bypass will never be activated.&lt;br /&gt;
&lt;br /&gt;
==  User interface ==&lt;br /&gt;
&lt;br /&gt;
==== What does the question mark on packets/bytes counters mean? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter stores historical traffic data in&lt;br /&gt;
different time resolutions depending on the age of the data.&lt;br /&gt;
&lt;br /&gt;
When zooming into a specific time window, packet and byte counters are&lt;br /&gt;
shown for this specific time interval only. Since the time resolution&lt;br /&gt;
available internally might be coarser than the selected zoom level,&lt;br /&gt;
the shown packet and byte values might not exactly represent the time&lt;br /&gt;
interval.&lt;br /&gt;
&lt;br /&gt;
If this is the case, the actual interval time is shown in square&lt;br /&gt;
brackets (for example [120s]). This means that the value represents&lt;br /&gt;
the time between the end of the selected interval (the right end of&lt;br /&gt;
the graph) and the shown number of seconds in the past.&lt;br /&gt;
&lt;br /&gt;
This value is shown to avoid confusion about unexpected values due to&lt;br /&gt;
interactive graph zooming.&lt;br /&gt;
&lt;br /&gt;
==== How can I print statistics? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter web interface can be printed by using&lt;br /&gt;
the built-in printing support of your browser. Just navigate to the desired&lt;br /&gt;
statistics and click on the printing button (Ctrl+P in most browsers). The pages&lt;br /&gt;
are optimized for printing. Tabs, PCAP and navigation buttons are hidden in&lt;br /&gt;
print mode.&lt;br /&gt;
&lt;br /&gt;
If the browser is truncating the page in print preview, you can try to use&lt;br /&gt;
&#039;&#039;&#039;Shrink to fit&#039;&#039;&#039; option (Firefox) or use a smaller scaling than 100% (Chrome).&lt;br /&gt;
You can also use another page orientation and change between &#039;&#039;&#039;landscape&#039;&#039;&#039; or &#039;&#039;&#039;portrait&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
==  Packet ring buffer ==&lt;br /&gt;
&lt;br /&gt;
==== Which time stamps are used during packet ring buffer replay? ==== &lt;br /&gt;
&lt;br /&gt;
Packet ring buffer replay will use the original time stamps of the packets as they were captured. Therefore the replay&lt;br /&gt;
recreates the original sequence and timing of packets in the displayed statistics.&lt;br /&gt;
&lt;br /&gt;
==  Capturing ==&lt;br /&gt;
&lt;br /&gt;
==== How many captures can be used in parallel? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter 200 supports up to 3 parallel and the&lt;br /&gt;
1000/3000 model supports up to 4 parallel captures. If the memory&lt;br /&gt;
usage is too high, the number of parallel captures might be lower.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=FAQ&amp;diff=2820</id>
		<title>FAQ</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=FAQ&amp;diff=2820"/>
		<updated>2020-05-14T13:04:43Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* What kind of user data is stored on the Allegro Network Multimeter */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Setup == &lt;br /&gt;
==== What is the difference between the Monitor interfaces and the Management interfaces? ==== &lt;br /&gt;
&lt;br /&gt;
The Monitor interfaces are used to passively analyze traffic and cannot be used for management functions such as accessing&lt;br /&gt;
the user interface. These interfaces do not generate any traffic apart from forwarding traffic received on the adjacent&lt;br /&gt;
interface if configured to Bridge mode.&lt;br /&gt;
The Management interface on the other hand, is dedicated for management functions like accessing the user interface,&lt;br /&gt;
downloading and uploading pcaps, streaming captured data to the device for analysis and so on. The Management&lt;br /&gt;
interface actively participates in the network it is connected to.&lt;br /&gt;
&lt;br /&gt;
==== How can I monitor the traffic of a single computer? ====&lt;br /&gt;
&lt;br /&gt;
The easiest way of monitoring and analyzing the traffic of a single device like a computer is to configure the&lt;br /&gt;
Allegro Network Multimeter in Bridge mode. The device to be monitored is connected to one interface of a bridged pair&lt;br /&gt;
of interfaces on the Allegro Network Multimeter. The other interface of the bridged pair is connected to the&lt;br /&gt;
network to which the device would normally be directly connected.&lt;br /&gt;
&lt;br /&gt;
In a setup like this, the Allegro Network Multimeter transparently forwards traffic between the device and the&lt;br /&gt;
network while providing full insight into the traffic between the device and the network.&lt;br /&gt;
&lt;br /&gt;
==== What is the difference between Bridge mode and Sink mode? ====&lt;br /&gt;
&lt;br /&gt;
If the Allegro Network Multimeter is configured to Sink mode, all Monitor interfaces act in a similar way in that they &lt;br /&gt;
receive traffic which is then analyzed by the appliance but not forwarded. The appliance acts as a traffic&lt;br /&gt;
sink, as it receives packets, analyzes them and discards them. This mode is ideally suited for situations&lt;br /&gt;
where traffic is already a copy; for example, on a Mirror Port of a Switch or on a network traffic Tap.&lt;br /&gt;
&lt;br /&gt;
If configured in Bridge mode, the Allegro Network Multimeter transparently forwards all traffic between adjacent Monitor&lt;br /&gt;
interfaces while simultaneously analyzing the forwarded traffic. The appliance acts as a network Bridge and can &lt;br /&gt;
be connected between two network devices which would normally be connected directly to each other. This mode&lt;br /&gt;
is suited for inserting the Allegro Network Multimeter directly into a point of the network without the need of a separate network&lt;br /&gt;
Tap or other means of providing a copy of the network traffic.&lt;br /&gt;
&lt;br /&gt;
==== I have used the LAN Management interface but I do not know the leased IP. How can I get the assigned IP address? ====&lt;br /&gt;
&lt;br /&gt;
===== DHCP server =====&lt;br /&gt;
&lt;br /&gt;
If the selected DHCP server provides some kind of log output or an overview of devices for which IP address leases have&lt;br /&gt;
been granted, it might help to search for a device with a hostname that starts with &#039;&#039;&#039;allegro-mm-&#039;&#039;&#039; followed by a four&lt;br /&gt;
digit hexadecimal number. The Allegro Network Multimeter announces itself with this hostname when it requests a&lt;br /&gt;
DHCP lease and should be traceable in the DHCP server info.&lt;br /&gt;
&lt;br /&gt;
===== WI-FI =====&lt;br /&gt;
&lt;br /&gt;
Every Allegro Network Multimeter comes with an USB to Wi-Fi adapter. In the factory default configuration the adapter will&lt;br /&gt;
create a wi-Fi Access Point when connected to the appliance. This Access Point shows up as &#039;&#039;&#039;allegro-mm-xxxx&#039;&#039;&#039; where the&lt;br /&gt;
&#039;&#039;&#039;xxxx&#039;&#039;&#039; part consists of a hexadecimal number which is unique to the device. In factory default settings the password&lt;br /&gt;
for the Wi-Fi network is &#039;&#039;&#039;Allegro-MM&#039;&#039;&#039; (without the quotes). As soon as there is a connection to Wi-Fi, the user&lt;br /&gt;
interface of the device can be accessed by either browsing to https://allegro or https://192.168.4.1.&lt;br /&gt;
When access to the user interface is established, the IP address of the LAN Management interface can be found under&lt;br /&gt;
&#039;&#039;&#039;Settings&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;Management interface settings&#039;&#039;&#039; in the &#039;&#039;&#039;Active interfaces&#039;&#039;&#039; section.&lt;br /&gt;
&lt;br /&gt;
===== Display =====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter 200 comes with a HDMI connector and&lt;br /&gt;
the 1000 and 3000 series come with a VGA connector.  When a compatible&lt;br /&gt;
display is connected, the console displays information about the running&lt;br /&gt;
Firmware version along with information on the configured&lt;br /&gt;
management network IP addresses. On the 200 model the&lt;br /&gt;
display must be connected before starting the appliance to obtain the output.&lt;br /&gt;
&lt;br /&gt;
===== KVM =====&lt;br /&gt;
&lt;br /&gt;
The video output of the device displaying the management IP addresses can be viewed over the network using the [[IPMI KVM on Allegro series 1000+|KVM/IPMI management module of the 1000 or 3000 series]]. Please see the FAQ entry &#039;&#039;&#039;What can I do with the integrated KVM port?&#039;&#039;&#039; on how to get started.&lt;br /&gt;
&lt;br /&gt;
==== What can I do with the integrated KVM port? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter 1000 and 3000 series devices contain a KVM/IPMI management module from Supermicro by&lt;br /&gt;
which several hardware management functions like powering the device on and off, system health messages and much&lt;br /&gt;
more can be accessed. It is also possible to view the video output of the device over the network from which the&lt;br /&gt;
current active management IP addresses can be retrieved.&lt;br /&gt;
&lt;br /&gt;
By default the KVM/IPMI management module will obtain an IP address through DHCP and the default user name as well&lt;br /&gt;
as default password is &#039;&#039;&#039;ADMIN&#039;&#039;&#039; (without the quotes).&lt;br /&gt;
&lt;br /&gt;
See [[IPMI KVM on Allegro series 1000+]] for additional information.&lt;br /&gt;
&lt;br /&gt;
==== I do not have a Wi-Fi client and I do not have a DHCP server. How can I access the Allegro Network Multimeter? ==== &lt;br /&gt;
&lt;br /&gt;
It is possible to make the Allegro Network Multimeter set a temporary static address on the LAN management interface.&lt;br /&gt;
It will return to the configured behaviour for the LAN management interface following the next restart.&lt;br /&gt;
&lt;br /&gt;
To enable the temporary static IP address, a USB keyboard is needed. When the keyboard is attached to one of the USB&lt;br /&gt;
ports of the Allegro, start the device. Wait for two minutes to make sure that the device is fully operational.&lt;br /&gt;
Then press and hold the &#039;&#039;&#039;shift&#039;&#039;&#039; key while pressing the &#039;&#039;&#039;s&#039;&#039;&#039; key. After this procedure the device will be configured to&lt;br /&gt;
use the IP address &#039;&#039;&#039;192.168.0.1&#039;&#039;&#039; on the LAN management interface. It is now possible to e.g. connect another&lt;br /&gt;
computer to the LAN management interface with an IP address statically configured to e.g. &#039;&#039;&#039;192.168.0.100&#039;&#039;&#039; and from&lt;br /&gt;
that computer the user interface of the Allegro is accessible at https://192.168.0.1.&lt;br /&gt;
If for some reason the IP address &#039;&#039;&#039;192.168.0.1&#039;&#039;&#039; is already used in the network, the Allegro will try to&lt;br /&gt;
set another IP address in the range of &#039;&#039;&#039;192.168.0.2&#039;&#039;&#039; - &#039;&#039;&#039;192.168.0.10&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
Once access to the user interface is established, a static IP address can be configured under &#039;&#039;&#039;Settings&#039;&#039;&#039; -&amp;gt;&lt;br /&gt;
&#039;&#039;&#039;Management interface settings&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
==  Data protection ==&lt;br /&gt;
&lt;br /&gt;
==== What kind of user data is stored on the Allegro Network Multimeter ====&lt;br /&gt;
&lt;br /&gt;
All metadata and statistics are stored in the device&#039;s main memory and are deleted as soon as the device is rebooted,&lt;br /&gt;
powered off, or packet processing is restarted. Any user data that can be derived from these statistics is therefore&lt;br /&gt;
only stored for the duration of continuous operation. If, however, reports are generated and stored on the device, these&lt;br /&gt;
reports exist until manually deleted or until a device configuration reset is performed.&lt;br /&gt;
&lt;br /&gt;
Raw packet data in the packet ring buffer or in stored pcap capture files will persist on the internal or external&lt;br /&gt;
storage until overwritten or deleted. If it is important that captured or deleted data must not be retrieved by someone&lt;br /&gt;
with physical access to the storage devices, it is possible to format the storage device with industry-standard full&lt;br /&gt;
disk encryption.&lt;br /&gt;
&lt;br /&gt;
==== How can I reset the Allegro Network Multimeter to a default configuration? ====&lt;br /&gt;
&lt;br /&gt;
There are two ways to reset the configuration of the device.&lt;br /&gt;
&lt;br /&gt;
The first option is to use the &#039;&#039;&#039;Reset System Configuration&#039;&#039;&#039; button which can be found under &#039;&#039;&#039;Settings&#039;&#039;&#039; -&amp;gt;&lt;br /&gt;
&#039;&#039;&#039;Administration&#039;&#039;&#039; in the user interface. After confirmation, this will trigger a restart of the system and afterwards the&lt;br /&gt;
device will be running with factory default settings.&lt;br /&gt;
&lt;br /&gt;
If, for some reason, the user interface is not accessible, a configuration reset can also be performed by attaching&lt;br /&gt;
an USB keyboard and a HDMI/VGA display to the device. When booting the device, there is a short period when a GNU GRUB&lt;br /&gt;
menu is displayed. The arrow up and arrow down keys can be used to select an entry and the selected entry can be chosen&lt;br /&gt;
by pressing the &#039;&#039;&#039;enter&#039;&#039;&#039; key. Below the default &#039;&#039;&#039;multimeter&#039;&#039;&#039; entry, there is a &#039;&#039;&#039;configuration-reset&#039;&#039;&#039; entry which will&lt;br /&gt;
perform a reset to default configuration and then reboot the device.&lt;br /&gt;
&lt;br /&gt;
Keep in mind that a reset to default configuration does not delete any&lt;br /&gt;
packet ring buffer data or captured files from internal or external&lt;br /&gt;
storage.&lt;br /&gt;
&lt;br /&gt;
==  System behavior ==&lt;br /&gt;
&lt;br /&gt;
==== Where does the Allegro Network Multimeter display L1 issues like bad CRC frames? ====&lt;br /&gt;
&lt;br /&gt;
Issues like these are accounted for the Monitoring interface on which the issue was encountered and the respective&lt;br /&gt;
statistics are available on the &#039;&#039;&#039;Interface stats&#039;&#039;&#039; page in the &#039;&#039;&#039;Errors&#039;&#039;&#039; column. For an explanation of the error&lt;br /&gt;
counters, please refer to the [[Interface_statistics|Interface statistics]] manual page.&lt;br /&gt;
&lt;br /&gt;
==== What happens in case of a system overload? ====&lt;br /&gt;
&lt;br /&gt;
In case of a system overload, a prominent warning is displayed at the top of the user interface for a few seconds&lt;br /&gt;
and these warnings and the time when the error occurred can be reviewed on the &#039;&#039;&#039;Info&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;Status&#039;&#039;&#039; page. As long as there are&lt;br /&gt;
still notifications on the &#039;&#039;&#039;Info&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;Status&#039;&#039;&#039; page, this is indicated by colored icons at the top of the user interface.&lt;br /&gt;
&lt;br /&gt;
If a system overload occurs and not all packets can be analyzed, these packets are accounted at the Monitoring&lt;br /&gt;
interface on which they were received. The counter can be found on the &#039;&#039;&#039;Interface stats&#039;&#039;&#039; page in the &#039;&#039;&#039;Errors&#039;&#039;&#039; column&lt;br /&gt;
under the &#039;&#039;&#039;Not processed&#039;&#039;&#039; section and is titled &#039;&#039;&#039;due to overload&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
When the Allegro Network Multimeter is operating in bridge mode and packets cannot be processed due to a system&lt;br /&gt;
overload, a software bypass will ensure that these packets are still forwarded to the adjacent Monitoring interface.&lt;br /&gt;
&lt;br /&gt;
==== What happens if the maximum number of stored connections has been reached? ====&lt;br /&gt;
&lt;br /&gt;
In this case, the Allegro Network Multimeter will start freeing up memory by removing historic statistical data which&lt;br /&gt;
lies before a certain point in time. This cutoff time is constantly adjusted to provide the best possible use of the&lt;br /&gt;
available memory. For how far back-in-time historical statistics are currently available, can be reviewed on the&lt;br /&gt;
&#039;&#039;&#039;Info&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;System Info&#039;&#039;&#039; page.&lt;br /&gt;
&lt;br /&gt;
==== I can only see the traffic of the last day. How can I increase this period? ====&lt;br /&gt;
&lt;br /&gt;
If the system does not provide a sufficient look back-in-time with the given traffic, it may help to deactivate certain&lt;br /&gt;
features that provide very detailed information but also consume a large amount of memory. Features that typically&lt;br /&gt;
fit into this category are the different settings of the &#039;&#039;&#039;IP statistics&#039;&#039;&#039;. These settings can be accessed by navigating to&lt;br /&gt;
&#039;&#039;&#039;IP&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;IP Statistics&#039;&#039;&#039; and clicking the &#039;&#039;&#039;Settings&#039;&#039;&#039; button at the top of the page. Especially turning off the&lt;br /&gt;
&#039;&#039;&#039;Store connection information for every IP&#039;&#039;&#039; and &#039;&#039;&#039;Store traffic history graph for IP peers&#039;&#039;&#039; settings can help saving&lt;br /&gt;
a lot of memory.&lt;br /&gt;
&lt;br /&gt;
==== What happens to the data after shutdown, reboot, or restart processing? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter uses an In-Memory database to store the&lt;br /&gt;
metadata of the packets it processes. This metadata will be lost when the&lt;br /&gt;
processing is stopped (shutdown, reboot, restart processing). This metadata&lt;br /&gt;
is also lost in case of an unexpected power loss.&lt;br /&gt;
&lt;br /&gt;
When using a packet ring buffer (see  [[Storage|storage]]), the packets will be&lt;br /&gt;
stored on the attached hard disk drive. This data is not lost after the&lt;br /&gt;
processing is stopped. It is possible to reanalyze the packet ringbuffer, but&lt;br /&gt;
this will interrupt the &#039;&#039;&#039;live&#039;&#039;&#039; mode, so no new packets will be processed.&lt;br /&gt;
&lt;br /&gt;
==  Allegro hardware ==&lt;br /&gt;
&lt;br /&gt;
==== What types of SFP modules are supported? ====&lt;br /&gt;
&lt;br /&gt;
See [[List_of_Supported_Transceiver_Modules|List of supported transceiver modules]] for details.&lt;br /&gt;
&lt;br /&gt;
==  Bypass ==&lt;br /&gt;
&lt;br /&gt;
==== What bypass options are available? ====&lt;br /&gt;
&lt;br /&gt;
Two bypass options are available:&lt;br /&gt;
&lt;br /&gt;
* a quad-port RJ45 1Gbps copper option supporting 1000BaseT and 100BaseT speeds. Each pair of interfaces makes up a bridged link with bypass.&lt;br /&gt;
* a dual-port 10Gbps fiber option with builtin SR transceivers and LC connectors. The two interfaces make up a bridged link with bypass.&lt;br /&gt;
&lt;br /&gt;
==== How does the bypass work? ====&lt;br /&gt;
&lt;br /&gt;
If the Allegro Network Multimeter contains a bypass option, it is only active when the device is configured to operate&lt;br /&gt;
in bridge mode. The bypass activates when the device is powered off, when the device is starting but is not yet&lt;br /&gt;
processing traffic or when an unexpected failure like a crash or a power loss occurs. If the bypass is active, the&lt;br /&gt;
two interfaces that make up a bypass link will be physically connected to each other so that devices connected on&lt;br /&gt;
either side will always find a working link.&lt;br /&gt;
&lt;br /&gt;
If the device is operating in sink mode, the bypass interfaces will act just like all the other interfaces on the device&lt;br /&gt;
and the bypass will never be activated.&lt;br /&gt;
&lt;br /&gt;
==  User interface ==&lt;br /&gt;
&lt;br /&gt;
==== What does the question mark on packets/bytes counters mean? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter stores historical traffic data in&lt;br /&gt;
different time resolutions depending on the age of the data.&lt;br /&gt;
&lt;br /&gt;
When zooming into a specific time window, packet and byte counters are&lt;br /&gt;
shown for this specific time interval only. Since the time resolution&lt;br /&gt;
available internally might be coarser than the selected zoom level,&lt;br /&gt;
the shown packet and byte values might not exactly represent the time&lt;br /&gt;
interval.&lt;br /&gt;
&lt;br /&gt;
If this is the case, the actual interval time is shown in square&lt;br /&gt;
brackets (for example [120s]). This means that the value represents&lt;br /&gt;
the time between the end of the selected interval (the right end of&lt;br /&gt;
the graph) and the shown number of seconds in the past.&lt;br /&gt;
&lt;br /&gt;
This value is shown to avoid confusion about unexpected values due to&lt;br /&gt;
interactive graph zooming.&lt;br /&gt;
&lt;br /&gt;
==== How can I print statistics? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter web interface can be printed by using&lt;br /&gt;
the built-in printing support of your browser. Just navigate to the desired&lt;br /&gt;
statistics and click on the printing button (Ctrl+P in most browsers). The pages&lt;br /&gt;
are optimized for printing. Tabs, PCAP and navigation buttons are hidden in&lt;br /&gt;
print mode.&lt;br /&gt;
&lt;br /&gt;
If the browser is truncating the page in print preview, you can try to use&lt;br /&gt;
&#039;&#039;&#039;Shrink to fit&#039;&#039;&#039; option (Firefox) or use a smaller scaling than 100% (Chrome).&lt;br /&gt;
You can also use another page orientation and change between &#039;&#039;&#039;landscape&#039;&#039;&#039; or &#039;&#039;&#039;portrait&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
==  Packet ring buffer ==&lt;br /&gt;
&lt;br /&gt;
==== Which time stamps are used during packet ring buffer replay? ==== &lt;br /&gt;
&lt;br /&gt;
Packet ring buffer replay will use the original time stamps of the packets as they were captured. Therefore the replay&lt;br /&gt;
recreates the original sequence and timing of packets in the displayed statistics.&lt;br /&gt;
&lt;br /&gt;
==  Capturing ==&lt;br /&gt;
&lt;br /&gt;
==== How many captures can be used in parallel? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter 200 supports up to 3 parallel and the&lt;br /&gt;
1000/3000 model supports up to 4 parallel captures. If the memory&lt;br /&gt;
usage is too high, the number of parallel captures might be lower.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
	<entry>
		<id>https://allegro-packets.com/wiki/index.php?title=FAQ&amp;diff=2819</id>
		<title>FAQ</title>
		<link rel="alternate" type="text/html" href="https://allegro-packets.com/wiki/index.php?title=FAQ&amp;diff=2819"/>
		<updated>2020-05-14T13:02:49Z</updated>

		<summary type="html">&lt;p&gt;David.Griffiths: /* I do not have a WIFI client and I do not have a DHCP server. How can I access the Allegro Network Multimeter? */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;== Setup == &lt;br /&gt;
==== What is the difference between the Monitor interfaces and the Management interfaces? ==== &lt;br /&gt;
&lt;br /&gt;
The Monitor interfaces are used to passively analyze traffic and cannot be used for management functions such as accessing&lt;br /&gt;
the user interface. These interfaces do not generate any traffic apart from forwarding traffic received on the adjacent&lt;br /&gt;
interface if configured to Bridge mode.&lt;br /&gt;
The Management interface on the other hand, is dedicated for management functions like accessing the user interface,&lt;br /&gt;
downloading and uploading pcaps, streaming captured data to the device for analysis and so on. The Management&lt;br /&gt;
interface actively participates in the network it is connected to.&lt;br /&gt;
&lt;br /&gt;
==== How can I monitor the traffic of a single computer? ====&lt;br /&gt;
&lt;br /&gt;
The easiest way of monitoring and analyzing the traffic of a single device like a computer is to configure the&lt;br /&gt;
Allegro Network Multimeter in Bridge mode. The device to be monitored is connected to one interface of a bridged pair&lt;br /&gt;
of interfaces on the Allegro Network Multimeter. The other interface of the bridged pair is connected to the&lt;br /&gt;
network to which the device would normally be directly connected.&lt;br /&gt;
&lt;br /&gt;
In a setup like this, the Allegro Network Multimeter transparently forwards traffic between the device and the&lt;br /&gt;
network while providing full insight into the traffic between the device and the network.&lt;br /&gt;
&lt;br /&gt;
==== What is the difference between Bridge mode and Sink mode? ====&lt;br /&gt;
&lt;br /&gt;
If the Allegro Network Multimeter is configured to Sink mode, all Monitor interfaces act in a similar way in that they &lt;br /&gt;
receive traffic which is then analyzed by the appliance but not forwarded. The appliance acts as a traffic&lt;br /&gt;
sink, as it receives packets, analyzes them and discards them. This mode is ideally suited for situations&lt;br /&gt;
where traffic is already a copy; for example, on a Mirror Port of a Switch or on a network traffic Tap.&lt;br /&gt;
&lt;br /&gt;
If configured in Bridge mode, the Allegro Network Multimeter transparently forwards all traffic between adjacent Monitor&lt;br /&gt;
interfaces while simultaneously analyzing the forwarded traffic. The appliance acts as a network Bridge and can &lt;br /&gt;
be connected between two network devices which would normally be connected directly to each other. This mode&lt;br /&gt;
is suited for inserting the Allegro Network Multimeter directly into a point of the network without the need of a separate network&lt;br /&gt;
Tap or other means of providing a copy of the network traffic.&lt;br /&gt;
&lt;br /&gt;
==== I have used the LAN Management interface but I do not know the leased IP. How can I get the assigned IP address? ====&lt;br /&gt;
&lt;br /&gt;
===== DHCP server =====&lt;br /&gt;
&lt;br /&gt;
If the selected DHCP server provides some kind of log output or an overview of devices for which IP address leases have&lt;br /&gt;
been granted, it might help to search for a device with a hostname that starts with &#039;&#039;&#039;allegro-mm-&#039;&#039;&#039; followed by a four&lt;br /&gt;
digit hexadecimal number. The Allegro Network Multimeter announces itself with this hostname when it requests a&lt;br /&gt;
DHCP lease and should be traceable in the DHCP server info.&lt;br /&gt;
&lt;br /&gt;
===== WI-FI =====&lt;br /&gt;
&lt;br /&gt;
Every Allegro Network Multimeter comes with an USB to Wi-Fi adapter. In the factory default configuration the adapter will&lt;br /&gt;
create a wi-Fi Access Point when connected to the appliance. This Access Point shows up as &#039;&#039;&#039;allegro-mm-xxxx&#039;&#039;&#039; where the&lt;br /&gt;
&#039;&#039;&#039;xxxx&#039;&#039;&#039; part consists of a hexadecimal number which is unique to the device. In factory default settings the password&lt;br /&gt;
for the Wi-Fi network is &#039;&#039;&#039;Allegro-MM&#039;&#039;&#039; (without the quotes). As soon as there is a connection to Wi-Fi, the user&lt;br /&gt;
interface of the device can be accessed by either browsing to https://allegro or https://192.168.4.1.&lt;br /&gt;
When access to the user interface is established, the IP address of the LAN Management interface can be found under&lt;br /&gt;
&#039;&#039;&#039;Settings&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;Management interface settings&#039;&#039;&#039; in the &#039;&#039;&#039;Active interfaces&#039;&#039;&#039; section.&lt;br /&gt;
&lt;br /&gt;
===== Display =====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter 200 comes with a HDMI connector and&lt;br /&gt;
the 1000 and 3000 series come with a VGA connector.  When a compatible&lt;br /&gt;
display is connected, the console displays information about the running&lt;br /&gt;
Firmware version along with information on the configured&lt;br /&gt;
management network IP addresses. On the 200 model the&lt;br /&gt;
display must be connected before starting the appliance to obtain the output.&lt;br /&gt;
&lt;br /&gt;
===== KVM =====&lt;br /&gt;
&lt;br /&gt;
The video output of the device displaying the management IP addresses can be viewed over the network using the [[IPMI KVM on Allegro series 1000+|KVM/IPMI management module of the 1000 or 3000 series]]. Please see the FAQ entry &#039;&#039;&#039;What can I do with the integrated KVM port?&#039;&#039;&#039; on how to get started.&lt;br /&gt;
&lt;br /&gt;
==== What can I do with the integrated KVM port? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter 1000 and 3000 series devices contain a KVM/IPMI management module from Supermicro by&lt;br /&gt;
which several hardware management functions like powering the device on and off, system health messages and much&lt;br /&gt;
more can be accessed. It is also possible to view the video output of the device over the network from which the&lt;br /&gt;
current active management IP addresses can be retrieved.&lt;br /&gt;
&lt;br /&gt;
By default the KVM/IPMI management module will obtain an IP address through DHCP and the default user name as well&lt;br /&gt;
as default password is &#039;&#039;&#039;ADMIN&#039;&#039;&#039; (without the quotes).&lt;br /&gt;
&lt;br /&gt;
See [[IPMI KVM on Allegro series 1000+]] for additional information.&lt;br /&gt;
&lt;br /&gt;
==== I do not have a Wi-Fi client and I do not have a DHCP server. How can I access the Allegro Network Multimeter? ==== &lt;br /&gt;
&lt;br /&gt;
It is possible to make the Allegro Network Multimeter set a temporary static address on the LAN management interface.&lt;br /&gt;
It will return to the configured behaviour for the LAN management interface following the next restart.&lt;br /&gt;
&lt;br /&gt;
To enable the temporary static IP address, a USB keyboard is needed. When the keyboard is attached to one of the USB&lt;br /&gt;
ports of the Allegro, start the device. Wait for two minutes to make sure that the device is fully operational.&lt;br /&gt;
Then press and hold the &#039;&#039;&#039;shift&#039;&#039;&#039; key while pressing the &#039;&#039;&#039;s&#039;&#039;&#039; key. After this procedure the device will be configured to&lt;br /&gt;
use the IP address &#039;&#039;&#039;192.168.0.1&#039;&#039;&#039; on the LAN management interface. It is now possible to e.g. connect another&lt;br /&gt;
computer to the LAN management interface with an IP address statically configured to e.g. &#039;&#039;&#039;192.168.0.100&#039;&#039;&#039; and from&lt;br /&gt;
that computer the user interface of the Allegro is accessible at https://192.168.0.1.&lt;br /&gt;
If for some reason the IP address &#039;&#039;&#039;192.168.0.1&#039;&#039;&#039; is already used in the network, the Allegro will try to&lt;br /&gt;
set another IP address in the range of &#039;&#039;&#039;192.168.0.2&#039;&#039;&#039; - &#039;&#039;&#039;192.168.0.10&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
Once access to the user interface is established, a static IP address can be configured under &#039;&#039;&#039;Settings&#039;&#039;&#039; -&amp;gt;&lt;br /&gt;
&#039;&#039;&#039;Management interface settings&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
==  Data protection ==&lt;br /&gt;
&lt;br /&gt;
==== What kind of user data is stored on the Allegro Network Multimeter ====&lt;br /&gt;
&lt;br /&gt;
All metadata and statistics are stored in the device&#039;s main memory and are gone as soon as the device is rebooted,&lt;br /&gt;
powered off or the packet processing is restarted. Any user data that can be derived from these statistics is therefore&lt;br /&gt;
only stored for the duration of continuous operation. If, however, reports are generated and stored on the device, these&lt;br /&gt;
reports exist until manually deleted or until a device configuration reset is performed.&lt;br /&gt;
&lt;br /&gt;
Raw packet data in the packet ring buffer or in stored PCAP capture files will persist on the internal or external&lt;br /&gt;
storage until overwritten or deleted. If it is important that captured or deleted data cannot be retrieved by someone&lt;br /&gt;
with physical access to the storage devices, it is possible to format the storage device with industry-standard full&lt;br /&gt;
disk encryption.&lt;br /&gt;
&lt;br /&gt;
==== How can I reset the Allegro Network Multimeter to a default configuration? ====&lt;br /&gt;
&lt;br /&gt;
There are two ways to reset the configuration of the device.&lt;br /&gt;
&lt;br /&gt;
The first option is to use the &#039;&#039;&#039;Reset System Configuration&#039;&#039;&#039; button which can be found under &#039;&#039;&#039;Settings&#039;&#039;&#039; -&amp;gt;&lt;br /&gt;
&#039;&#039;&#039;Administration&#039;&#039;&#039; in the user interface. After confirmation, this will trigger a restart of the system and afterwards the&lt;br /&gt;
device will be running with factory default settings.&lt;br /&gt;
&lt;br /&gt;
If, for some reason, the user interface is not accessible, a configuration reset can also be performed by attaching&lt;br /&gt;
an USB keyboard and a HDMI/VGA display to the device. When booting the device, there is a short period when a GNU GRUB&lt;br /&gt;
menu is displayed. The arrow up and arrow down keys can be used to select an entry and the selected entry can be chosen&lt;br /&gt;
by pressing the &#039;&#039;&#039;enter&#039;&#039;&#039; key. Below the default &#039;&#039;&#039;multimeter&#039;&#039;&#039; entry, there is a &#039;&#039;&#039;configuration-reset&#039;&#039;&#039; entry which will&lt;br /&gt;
perform a reset to default configuration and then reboot the device.&lt;br /&gt;
&lt;br /&gt;
Keep in mind that a reset to default configuration does not delete any&lt;br /&gt;
packet ring buffer data or captured files from internal or external&lt;br /&gt;
storage.&lt;br /&gt;
&lt;br /&gt;
==  System behavior ==&lt;br /&gt;
&lt;br /&gt;
==== Where does the Allegro Network Multimeter display L1 issues like bad CRC frames? ====&lt;br /&gt;
&lt;br /&gt;
Issues like these are accounted for the Monitoring interface on which the issue was encountered and the respective&lt;br /&gt;
statistics are available on the &#039;&#039;&#039;Interface stats&#039;&#039;&#039; page in the &#039;&#039;&#039;Errors&#039;&#039;&#039; column. For an explanation of the error&lt;br /&gt;
counters, please refer to the [[Interface_statistics|Interface statistics]] manual page.&lt;br /&gt;
&lt;br /&gt;
==== What happens in case of a system overload? ====&lt;br /&gt;
&lt;br /&gt;
In case of a system overload, a prominent warning is displayed at the top of the user interface for a few seconds&lt;br /&gt;
and these warnings and the time when the error occurred can be reviewed on the &#039;&#039;&#039;Info&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;Status&#039;&#039;&#039; page. As long as there are&lt;br /&gt;
still notifications on the &#039;&#039;&#039;Info&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;Status&#039;&#039;&#039; page, this is indicated by colored icons at the top of the user interface.&lt;br /&gt;
&lt;br /&gt;
If a system overload occurs and not all packets can be analyzed, these packets are accounted at the Monitoring&lt;br /&gt;
interface on which they were received. The counter can be found on the &#039;&#039;&#039;Interface stats&#039;&#039;&#039; page in the &#039;&#039;&#039;Errors&#039;&#039;&#039; column&lt;br /&gt;
under the &#039;&#039;&#039;Not processed&#039;&#039;&#039; section and is titled &#039;&#039;&#039;due to overload&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
When the Allegro Network Multimeter is operating in bridge mode and packets cannot be processed due to a system&lt;br /&gt;
overload, a software bypass will ensure that these packets are still forwarded to the adjacent Monitoring interface.&lt;br /&gt;
&lt;br /&gt;
==== What happens if the maximum number of stored connections has been reached? ====&lt;br /&gt;
&lt;br /&gt;
In this case, the Allegro Network Multimeter will start freeing up memory by removing historic statistical data which&lt;br /&gt;
lies before a certain point in time. This cutoff time is constantly adjusted to provide the best possible use of the&lt;br /&gt;
available memory. For how far back-in-time historical statistics are currently available, can be reviewed on the&lt;br /&gt;
&#039;&#039;&#039;Info&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;System Info&#039;&#039;&#039; page.&lt;br /&gt;
&lt;br /&gt;
==== I can only see the traffic of the last day. How can I increase this period? ====&lt;br /&gt;
&lt;br /&gt;
If the system does not provide a sufficient look back-in-time with the given traffic, it may help to deactivate certain&lt;br /&gt;
features that provide very detailed information but also consume a large amount of memory. Features that typically&lt;br /&gt;
fit into this category are the different settings of the &#039;&#039;&#039;IP statistics&#039;&#039;&#039;. These settings can be accessed by navigating to&lt;br /&gt;
&#039;&#039;&#039;IP&#039;&#039;&#039; -&amp;gt; &#039;&#039;&#039;IP Statistics&#039;&#039;&#039; and clicking the &#039;&#039;&#039;Settings&#039;&#039;&#039; button at the top of the page. Especially turning off the&lt;br /&gt;
&#039;&#039;&#039;Store connection information for every IP&#039;&#039;&#039; and &#039;&#039;&#039;Store traffic history graph for IP peers&#039;&#039;&#039; settings can help saving&lt;br /&gt;
a lot of memory.&lt;br /&gt;
&lt;br /&gt;
==== What happens to the data after shutdown, reboot, or restart processing? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter uses an In-Memory database to store the&lt;br /&gt;
metadata of the packets it processes. This metadata will be lost when the&lt;br /&gt;
processing is stopped (shutdown, reboot, restart processing). This metadata&lt;br /&gt;
is also lost in case of an unexpected power loss.&lt;br /&gt;
&lt;br /&gt;
When using a packet ring buffer (see  [[Storage|storage]]), the packets will be&lt;br /&gt;
stored on the attached hard disk drive. This data is not lost after the&lt;br /&gt;
processing is stopped. It is possible to reanalyze the packet ringbuffer, but&lt;br /&gt;
this will interrupt the &#039;&#039;&#039;live&#039;&#039;&#039; mode, so no new packets will be processed.&lt;br /&gt;
&lt;br /&gt;
==  Allegro hardware ==&lt;br /&gt;
&lt;br /&gt;
==== What types of SFP modules are supported? ====&lt;br /&gt;
&lt;br /&gt;
See [[List_of_Supported_Transceiver_Modules|List of supported transceiver modules]] for details.&lt;br /&gt;
&lt;br /&gt;
==  Bypass ==&lt;br /&gt;
&lt;br /&gt;
==== What bypass options are available? ====&lt;br /&gt;
&lt;br /&gt;
Two bypass options are available:&lt;br /&gt;
&lt;br /&gt;
* a quad-port RJ45 1Gbps copper option supporting 1000BaseT and 100BaseT speeds. Each pair of interfaces makes up a bridged link with bypass.&lt;br /&gt;
* a dual-port 10Gbps fiber option with builtin SR transceivers and LC connectors. The two interfaces make up a bridged link with bypass.&lt;br /&gt;
&lt;br /&gt;
==== How does the bypass work? ====&lt;br /&gt;
&lt;br /&gt;
If the Allegro Network Multimeter contains a bypass option, it is only active when the device is configured to operate&lt;br /&gt;
in bridge mode. The bypass activates when the device is powered off, when the device is starting but is not yet&lt;br /&gt;
processing traffic or when an unexpected failure like a crash or a power loss occurs. If the bypass is active, the&lt;br /&gt;
two interfaces that make up a bypass link will be physically connected to each other so that devices connected on&lt;br /&gt;
either side will always find a working link.&lt;br /&gt;
&lt;br /&gt;
If the device is operating in sink mode, the bypass interfaces will act just like all the other interfaces on the device&lt;br /&gt;
and the bypass will never be activated.&lt;br /&gt;
&lt;br /&gt;
==  User interface ==&lt;br /&gt;
&lt;br /&gt;
==== What does the question mark on packets/bytes counters mean? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter stores historical traffic data in&lt;br /&gt;
different time resolutions depending on the age of the data.&lt;br /&gt;
&lt;br /&gt;
When zooming into a specific time window, packet and byte counters are&lt;br /&gt;
shown for this specific time interval only. Since the time resolution&lt;br /&gt;
available internally might be coarser than the selected zoom level,&lt;br /&gt;
the shown packet and byte values might not exactly represent the time&lt;br /&gt;
interval.&lt;br /&gt;
&lt;br /&gt;
If this is the case, the actual interval time is shown in square&lt;br /&gt;
brackets (for example [120s]). This means that the value represents&lt;br /&gt;
the time between the end of the selected interval (the right end of&lt;br /&gt;
the graph) and the shown number of seconds in the past.&lt;br /&gt;
&lt;br /&gt;
This value is shown to avoid confusion about unexpected values due to&lt;br /&gt;
interactive graph zooming.&lt;br /&gt;
&lt;br /&gt;
==== How can I print statistics? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter web interface can be printed by using&lt;br /&gt;
the built-in printing support of your browser. Just navigate to the desired&lt;br /&gt;
statistics and click on the printing button (Ctrl+P in most browsers). The pages&lt;br /&gt;
are optimized for printing. Tabs, PCAP and navigation buttons are hidden in&lt;br /&gt;
print mode.&lt;br /&gt;
&lt;br /&gt;
If the browser is truncating the page in print preview, you can try to use&lt;br /&gt;
&#039;&#039;&#039;Shrink to fit&#039;&#039;&#039; option (Firefox) or use a smaller scaling than 100% (Chrome).&lt;br /&gt;
You can also use another page orientation and change between &#039;&#039;&#039;landscape&#039;&#039;&#039; or &#039;&#039;&#039;portrait&#039;&#039;&#039;.&lt;br /&gt;
&lt;br /&gt;
==  Packet ring buffer ==&lt;br /&gt;
&lt;br /&gt;
==== Which time stamps are used during packet ring buffer replay? ==== &lt;br /&gt;
&lt;br /&gt;
Packet ring buffer replay will use the original time stamps of the packets as they were captured. Therefore the replay&lt;br /&gt;
recreates the original sequence and timing of packets in the displayed statistics.&lt;br /&gt;
&lt;br /&gt;
==  Capturing ==&lt;br /&gt;
&lt;br /&gt;
==== How many captures can be used in parallel? ====&lt;br /&gt;
&lt;br /&gt;
The Allegro Network Multimeter 200 supports up to 3 parallel and the&lt;br /&gt;
1000/3000 model supports up to 4 parallel captures. If the memory&lt;br /&gt;
usage is too high, the number of parallel captures might be lower.&lt;/div&gt;</summary>
		<author><name>David.Griffiths</name></author>
	</entry>
</feed>