Capturing: Difference between revisions

From Allegro Network Multimeter Manual
Jump to navigation Jump to search
Access restrictions were established for this page. If you see this message, you have no access to this page.
m (Martin.fesser moved page 5- Capturing to Capturing)
No edit summary
 
(51 intermediate revisions by 8 users not shown)
Line 1: Line 1:
With the Allegro Network Multimeter it is possible to create a capture in
== Introduction ==
PCAP format which can be opened in tools such as Wireshark.
Network administrators frequently require capturing specific network traffic for troubleshooting intermittent connection issues, analyzing security incidents, or diagnosing performance bottlenecks.<br>
With the Allegro Network Multimeter it is very easy to start and retrieve very specific network packet captures in pcap format.<br>Such pre-filtered pcap files, can then easily be investigated with Allegro Network Multimeter's built in Webshark or a tool like Wireshark.
 
== How can I create a pcap of a specific IP or MAC address? ==
All Allegro Network Multimeter L2-L7 analysis modules, feature dedicated pcap buttons throughout the dashboard,
to <u>very specifically</u> capture most traffic types in a really easy way.
 
For example; to capture a specific IP address, in the left menu navigate to 'L3 - IP' -> 'IP' statistics.<br>
Then, easily find the desired IP address by sorting and/or a filtered search, and clicking the capture button - [[File:Capture button.png]].
 
When a specific time interval is displayed in the dashboard, only the payload during that time interval is extracted.
[[File:IP pcap.png|none|thumb|800x800px|alt=]]
 
To quickly find an IP address, you can sort the IP table via almost every column. The search bar/filter bar provides a quick method to reduce the table content to your hearts content.<br>This can be done by typing in (fragments of) the
IP address, (fragments of) the DNS name or by entering a "complex" filter.
 
[[File:Search bar.png|1100px|thumb|alt=|none]]


<br>
== ''' How can I get a PCAP of a certain IP or MAC address?''' ==
The different modules of the *Allegro Network Multimeter* provide a dedicated PCAP button
for nearly every type of traffic that allows to capture that particular
traffic. For capturing a certain IP address go to 'IP' -> 'IP' statistics, navigate to
the desired IP address and push the PCAP button.
{|
| [[File:Ap-mm-capture-ip-statistics.png|600px|thumb|right]]
|}


To find an IP faster, you can sort the IP table by almost every column. The filter
offers a quick way to reduce the table content, e.g. by typing fragments of the
IP address or the DNS name in the filter input field.


Another quick way to get a PCAP of a certain address is the simple capture. Go
Another quick way to create a pcap of a specific address, is to use Allegro Network Multimeter's Simple Capture feature.
to 'Generic' -> 'Capture traffic', enable the MAC switch, set an address and push the
"Start capture" button.


In the menu go to 'Generic' -> 'Capture traffic'. Now, in the "start simple capture" section, toggle the desired capture fields (e.g. MAC, IP), type the address, and click the "Start capture" button.


{|
[[File:Ap-mm-capture-capture-simple.png|600px|thumb|alt=|none]]
|[[File:Ap-mm-capture-capture-simple.png|600px|thumb|right]]
|}


 
== Which settings should I choose? ==
<br>
== ''' What settings shall I choose?''' ==


After pushing the capture button the dialog "Choose capture settings" will be
After clicking on the capture button, the dialogue "Choose capture settings" will be
displayed. Here you can limit the start and end time of the capture and select
displayed. Here you can limit the start and end time of the capture and select
whether the created PCAP file is downloaded by your browser directly to your
whether to download the pcap file directly to your
computer or stored on the attached storage device of the Multimeter. You can
computer or store it on the Allegro Network Multimeter attached storage device. You can
limit the captured packets to the given length if you do not need the full packet
limit the captured packets to a given length if you do not need the full packet
and want a small PCAP file that opens faster in Wireshark.
and just want a small pcap file that opens faster in Wireshark.
[[File:Choose capture settings.png|none|thumb|600x600px]]


{|
Clicking the "Save capture" button begins the configured capture.
| [[File:Ap-mm-capture-choose-capture-settings.png|600px|thumb|right]]
|}


Pushing the "Start capture" begins the capture.
Clicking on the "Webshark preview" will open a basis web-based Wireshark window within the Allegro Network Multimeter web interface.


<br>
A fully detailed explanation of the "Choose Capture Settings" dialog is documented in our Wiki here: [[Capture module#Capture settings dialog]]
== '''How can I extract traffic from the past? ''' ==


By using the packet ring buffer of the *Allegro Network Multimeter* it is
== How can I extract traffic from the past? ==
possible to extract traffic from the past and create a PCAP. The packet ring
buffer is stored on the external storage device that is attached to the USB
port or an internal storage device if your *Allegro Network Multimeter* is
equipped with one. As external device a fast USB3 capable SSD is recommended. An
USB thumb drive can be used, too, but some packets of a burst may be dropped if the
thumb drive is too slow.


You can see an overview about all storage devices available to the Multimeter
With the Allegro Network Multimeter packet ring buffer, it is possible to extract traffic from the past as a pcap file. The packet ring buffer is stored on the internal storage device of an Allegro Network Multimeter (if your model is equipped with one), or on an externally attached USB storage device. A fast USB3.x capable SSD is recommended. A USB thumb drive can also be used, but some burst packets may be dropped if the thumb drive write speed is too slow.
under 'Generic' -> 'Storage'.


You can see an overview about all storage devices that can be used for the Allegro Network Multimeter under 'Generic' -> 'Storage'.
{|  
{|  
| [[File:Ap-mm-capture-storage.png|600px|thumb|right]]
| [[File:Ap-mm-capture-storage.png|600px|thumb|right]]
|}
|}


 
An external SSD is attached to the USB port and is not yet activated. Click the
An external SSD is attached to the USB port and is not activated yet. Push the
"Activate" button so the device can be used. If the filesystem of the disk is not
"Activate" button so the device can be used. If the filesystem of the disk is not
suitable for the ring buffer a warning will pop up and let you format the disk
suitable for the ring buffer a warning will pop up prompting you to format the disk.
properly. After formatting or activating the storage page will show informations
After formatting or activating, the storage page will display information
about disk usage and an overview off all files on the disk.
on disk usage and an overview of all files on the disk.


{|  
{|  
| [[File:Ap-mm-capture-storage-active.png|600px|thumb|right]]
| [[File:Ap-mm-capture-storage-active.png|600px|thumb|right]]
|}
|}


Now that the storage is active, the ring buffer has to be created if not already
Now that the storage is active, the ring buffer has to be created if not already
done during formatting. This can be done under 'Generic' -> 'Packet ring buffer'.
prepared during formatting. This can be achieved in 'Generic' -> 'Packet ring buffer'.
Push the "Create ring buffer" button.
Click the "Create ring buffer" button.


{|  
{|  
Line 81: Line 69:
|}
|}


The size of the ring buffer must be specified. If no pcap is required on
 
the storage device, the ring buffer will use 100% of the storage device capacity.
The size of the ring buffer has to be specified. If no PCAP shall be stored on
the storage device, the ring buffer may use 100% of the size of the device.


{|  
{|  
Line 90: Line 76:
|}
|}


When the packet ring buffer is created and running, the "Packet ring buffer"
statistics page displays information about the ring buffer usage and several
graphs restored or filtered traffic are also displayed. A filter can be applied
to determine which packets are stored in the ring buffer. Check out the chapter [[Packet ring buffer]] for more details.


When the packet ring buffer is created and running, the "Packet ring buffer"
statistics page shows information about the usage of the ring buffer and several
graphs about stored or filtered traffic are displayed. A filter can be applied
to control which packets are stored in the ring buffer. Check out the chapter
[[3-_Generic_modules(Teil_3)#Packet_ring_buffer|Packet ring buffer]] for more details.
{|  
{|  
|  
|  
Line 103: Line 86:
|}
|}


 
When the packet ring buffer is up and running, any capture may be utilized to
 
extract traffic from the past. Select a timespan in any graph of the user interface
 
by left-clicking with the mouse and then click a pcap button.
 
Now that the packet ring buffer is up and running, any capture can use it and
extract traffic from the past. Just select a timespan in any graph of the user interface
by left clicking with the mouse and then push a PCAP button.
The selected timespan will be displayed in the start and end time fields of the
The selected timespan will be displayed in the start and end time fields of the
"Choose capture settings" dialog.
"Choose capture settings" dialogue.


{|  
{|  
Line 118: Line 97:
|}
|}


Start and end time can be changed by using the date and time popup window when
Start and end times can be changed by using the date and time popup window when
selecting the time fields or pushing the dedicated buttons for commonly used times.
selecting the time fields or clicking the dedicated buttons for commonly used times.
If the start time is earlier than the start of the packet ring buffer, it will
If the start time is earlier than the start of the packet ring buffer, it will
be adjusted to the start and a hint will be displayed.
be adjusted to the start and a hint will be displayed.


== Is it possible to plan a future capture? ==


<br>
Yes. Simply select the desired start time in the "Choose capture settings" dialogue
== ''' Is it possible to plan a capture in the future?''' ==
 
Yes. Simply select the desired start time in the "Choose capture settings" dialog
and the capture will start with the first packet at that time.
and the capture will start with the first packet at that time.


On the 'Generic' -> 'Capture traffic' page there is also a tab 'Planned captures' where captures to a storage device can be configured and those captures can even be set to automatically repeat.


<br>
== Create complex captures with several criteria ==
== ''' Create complex captures with several criteria''' ==


Captures can be stared with complex filter expressions for a specific capture of e.g.
Captures can be started with complex filter expressions for a specific capture of e.g.
an IP address or a layer 7 protocol.
an IP address or a Layer 7 protocol.


To get a basic overview just start a capture from any module and the expression of
To see a basic overview, start a capture from any module. You can see all running active captures at the capture button at the top bar of the web interface.
that capture is shown by clicking on the "Active captures" button on top of every
page.


{|  
{|  
Line 146: Line 121:
|}
|}


 
On the "Start simple capture" page, all frequently
 
On the "Capture traffic" page, by using the simple capture method, all frequently
used filter expressions are easily accessible. The resulting expression is
used filter expressions are easily accessible. The resulting expression is
displayed below.
displayed below.
{|  
{|  
|  
|  
Line 157: Line 130:
|}
|}


This expression can be used and edited in the expert capture filter field. All
This expression can be used and edited in the expert filter field. All
filters can be combined with "and" / "&&" or "or" / "||". Parentheses may
filters can be combined with "and" / "&&" or "or" / "||". Parentheses may
be used to clarify precedence.
be used to clarify precedence.


The chapter [[1-_Generic_modules(Teil_1)#Capture_module|Capture module]] explains every possible filter.
The chapter [[Capture_module|Capture module]] explains every possible filter.


== Generate a pcap via the command line ==


<br>
It is easy to generate a pcap via the command line or in scripts with "curl"
== ''' Get a PCAP via command line''' ==
 
It is quite easy to get a PCAP on the command line or in scripts with "curl"
which is a tool available for recent versions of Windows 10, Linux and MacOS.
which is a tool available for recent versions of Windows 10, Linux and MacOS.


Basically it is just typing:
Just type:


{| class="wikitable"
{| class="wikitable"
Line 176: Line 147:
|}
|}


The user name, password and hostname have to be the same that are used to access
The user name, password and hostname have to be the same as the ones used to access
the web interface. Every filter expression that can be used in the web interface
the web interface. Every filter expression that can be used in the web interface
can also be used here.
can also be used here.


Check out the chapter [[1-_Generic_modules(Teil_1)#Capture_module|Capture module]] for further information.
Check out the chapter [[Capture_module|Capture module]] for further information.
 


<br>
== It takes too long to open a pcap file in Wireshark. What can I do? ==
== ''' It takes too long to open a PCAP file in Wireshark. What can I do?''' ==
If you are in a situation where you have a large pcap and are only
If you are in a situation where you have a huge PCAP and are just
interested in the traffic between two specific IP addresses, you can
interested in the traffic between two particular IP addresses, you can
use the Allegro Network Multimeter to analyze the pcap file and
use the *Allegro Network Multimeter* to analyze the pcap file and
extract the specific traffic for post-processing with tools such as
extract the specific traffic for post-processing with other tools like
Wireshark. See [[Forensic_pcap_Analysis|Forensic Pcap Analysis]] for details.
Wireshark. See [[2-_Forensic_Pcap_Analysis|Forensic Pcap Analysis]] for details.

Latest revision as of 06:51, 30 April 2025

Introduction

Network administrators frequently require capturing specific network traffic for troubleshooting intermittent connection issues, analyzing security incidents, or diagnosing performance bottlenecks.
With the Allegro Network Multimeter it is very easy to start and retrieve very specific network packet captures in pcap format.
Such pre-filtered pcap files, can then easily be investigated with Allegro Network Multimeter's built in Webshark or a tool like Wireshark.

How can I create a pcap of a specific IP or MAC address?

All Allegro Network Multimeter L2-L7 analysis modules, feature dedicated pcap buttons throughout the dashboard, to very specifically capture most traffic types in a really easy way.

For example; to capture a specific IP address, in the left menu navigate to 'L3 - IP' -> 'IP' statistics.
Then, easily find the desired IP address by sorting and/or a filtered search, and clicking the capture button - Capture button.png.

When a specific time interval is displayed in the dashboard, only the payload during that time interval is extracted.

To quickly find an IP address, you can sort the IP table via almost every column. The search bar/filter bar provides a quick method to reduce the table content to your hearts content.
This can be done by typing in (fragments of) the IP address, (fragments of) the DNS name or by entering a "complex" filter.


Another quick way to create a pcap of a specific address, is to use Allegro Network Multimeter's Simple Capture feature.

In the menu go to 'Generic' -> 'Capture traffic'. Now, in the "start simple capture" section, toggle the desired capture fields (e.g. MAC, IP), type the address, and click the "Start capture" button.

Which settings should I choose?

After clicking on the capture button, the dialogue "Choose capture settings" will be displayed. Here you can limit the start and end time of the capture and select whether to download the pcap file directly to your computer or store it on the Allegro Network Multimeter attached storage device. You can limit the captured packets to a given length if you do not need the full packet and just want a small pcap file that opens faster in Wireshark.

Choose capture settings.png

Clicking the "Save capture" button begins the configured capture.

Clicking on the "Webshark preview" will open a basis web-based Wireshark window within the Allegro Network Multimeter web interface.

A fully detailed explanation of the "Choose Capture Settings" dialog is documented in our Wiki here: Capture module#Capture settings dialog

How can I extract traffic from the past?

With the Allegro Network Multimeter packet ring buffer, it is possible to extract traffic from the past as a pcap file. The packet ring buffer is stored on the internal storage device of an Allegro Network Multimeter (if your model is equipped with one), or on an externally attached USB storage device. A fast USB3.x capable SSD is recommended. A USB thumb drive can also be used, but some burst packets may be dropped if the thumb drive write speed is too slow.

You can see an overview about all storage devices that can be used for the Allegro Network Multimeter under 'Generic' -> 'Storage'.

Ap-mm-capture-storage.png

An external SSD is attached to the USB port and is not yet activated. Click the "Activate" button so the device can be used. If the filesystem of the disk is not suitable for the ring buffer a warning will pop up prompting you to format the disk. After formatting or activating, the storage page will display information on disk usage and an overview of all files on the disk.

Ap-mm-capture-storage-active.png

Now that the storage is active, the ring buffer has to be created if not already prepared during formatting. This can be achieved in 'Generic' -> 'Packet ring buffer'. Click the "Create ring buffer" button.

Ap-mm-capture-create-ring-buffer.png

The size of the ring buffer must be specified. If no pcap is required on the storage device, the ring buffer will use 100% of the storage device capacity.

Ap-mm-capture-ring-buffer-size.png

When the packet ring buffer is created and running, the "Packet ring buffer" statistics page displays information about the ring buffer usage and several graphs restored or filtered traffic are also displayed. A filter can be applied to determine which packets are stored in the ring buffer. Check out the chapter Packet ring buffer for more details.

Ap-mm-capture-ring-buffer-statistics.png

When the packet ring buffer is up and running, any capture may be utilized to extract traffic from the past. Select a timespan in any graph of the user interface by left-clicking with the mouse and then click a pcap button. The selected timespan will be displayed in the start and end time fields of the "Choose capture settings" dialogue.

Ap-mm-capture-choose-capture-settings-2.png

Start and end times can be changed by using the date and time popup window when selecting the time fields or clicking the dedicated buttons for commonly used times. If the start time is earlier than the start of the packet ring buffer, it will be adjusted to the start and a hint will be displayed.

Is it possible to plan a future capture?

Yes. Simply select the desired start time in the "Choose capture settings" dialogue and the capture will start with the first packet at that time.

On the 'Generic' -> 'Capture traffic' page there is also a tab 'Planned captures' where captures to a storage device can be configured and those captures can even be set to automatically repeat.

Create complex captures with several criteria

Captures can be started with complex filter expressions for a specific capture of e.g. an IP address or a Layer 7 protocol.

To see a basic overview, start a capture from any module. You can see all running active captures at the capture button at the top bar of the web interface.

Ap-mm-capture-filter-expression.png

On the "Start simple capture" page, all frequently used filter expressions are easily accessible. The resulting expression is displayed below.

Ap-mm-capture-capture-simple-2.png

This expression can be used and edited in the expert filter field. All filters can be combined with "and" / "&&" or "or" / "||". Parentheses may be used to clarify precedence.

The chapter Capture module explains every possible filter.

Generate a pcap via the command line

It is easy to generate a pcap via the command line or in scripts with "curl" which is a tool available for recent versions of Windows 10, Linux and MacOS.

Just type:

curl -k -u USER:PASSWORD https://allegro-mm-XXXX/API/data/modules/capture?expression=ip==10.1.2.3 > path_to/capture.pcap

The user name, password and hostname have to be the same as the ones used to access the web interface. Every filter expression that can be used in the web interface can also be used here.

Check out the chapter Capture module for further information.

It takes too long to open a pcap file in Wireshark. What can I do?

If you are in a situation where you have a large pcap and are only interested in the traffic between two specific IP addresses, you can use the Allegro Network Multimeter to analyze the pcap file and extract the specific traffic for post-processing with tools such as Wireshark. See Forensic Pcap Analysis for details.

Retrieved from "https://allegro-packets.com/wiki/index.php?title=Capturing&oldid=5021"