Capturing: Difference between revisions

PCAP format which can be opened in tools such as Wireshark.

for nearly every type of traffic that allows to capture that particular

traffic. For capturing a certain IP address go to 'IP' -> 'IP' statistics, navigate to

the desired IP address and push the PCAP button.

{|  

| [[File:Ap-mm-capture-ip-statistics.png|600px|thumb|right]]

to 'Generic' -> 'Capture traffic', enable the MAC switch, set an address and push the

"Start capture" button.

{|  

|}

After pushing the capture button the dialog "Choose capture settings" will be

Pushing the "Start capture" begins the capture.

possible to extract traffic from the past and create a PCAP. The packet ring

buffer is stored on the external storage device that is attached to the USB

equipped with one. As external device a fast USB3 capable SSD is recommended. An

USB thumb drive can be used, too, but some packets of a burst may be dropped if the

| [[File:Ap-mm-capture-storage.png|600px|thumb|right]]

|}

An external SSD is attached to the USB port and is not activated yet. Push the

| [[File:Ap-mm-capture-storage-active.png|600px|thumb|right]]

|}

Now that the storage is active, the ring buffer has to be created if not already

| [[File:Ap-mm-capture-create-ring-buffer.png|600px|thumb|right]]

|}

The size of the ring buffer has to be specified. If no PCAP shall be stored on

|[[File:Ap-mm-capture-ring-buffer-size.png|600px|thumb|right]]

|}

When the packet ring buffer is created and running, the "Packet ring buffer"

graphs about stored or filtered traffic are displayed. A filter can be applied

to control which packets are stored in the ring buffer. Check out the chapter

{|  

|  

[[File:Ap-mm-capture-ring-buffer-statistics.png|600px|thumb|right]]

|}

Now that the packet ring buffer is up and running, any capture can use it and

be adjusted to the start and a hint will be displayed.

Yes. Simply select the desired start time in the "Choose capture settings" dialog

and the capture will start with the first packet at that time.

Captures can be stared with complex filter expressions for a specific capture of e.g.

[[File:Ap-mm-capture-filter-expression.png|600px|thumb|right]]

|}

On the "Capture traffic" page, by using the simple capture method, all frequently

used filter expressions are easily accessible. The resulting expression is

displayed below.

{|  

|  

The chapter [[1-_Generic_modules(Teil_1)#Capture_module|Capture module]] explains every possible filter.

It is quite easy to get a PCAP on the command line or in scripts with "curl"

Check out the chapter [[1-_Generic_modules(Teil_1)#Capture_module|Capture module]] for further information.

If you are in a situation where you have a huge PCAP and are just

interested in the traffic between two particular IP addresses, you can

extract the specific traffic for post-processing with other tools like