Ring Buffer Configuration Guide: Difference between revisions

From Allegro Network Multimeter Manual
Jump to navigation Jump to search
Access restrictions were established for this page. If you see this message, you have no access to this page.
mNo edit summary
 
(45 intermediate revisions by 7 users not shown)
Line 1: Line 1:
This section describes the '''Ring Buffer''' configuration and options for the Allegro Network Multimeter.
This section describes the '''ring buffer''' configuration and options for the Allegro Network Multimeter.


== What is the '''Ring Buffer''' ==
== What is the '''ring buffer?''' ==


[[File:Historic capture dialog.png|thumb|300px]]
[[File:Historic capture dialog.png|thumb|300px]]
The '''Ring Buffer''' is a packet buffer. It stores raw Ethernet packets on one or many '''storage devices'''. A '''storage device''' is an internal or external HDD or SSD. If the buffer is full, it will overwrite the oldest packets in a circular manner. The '''Ring Buffer''' is an optional feature for the Allegro Network Multimeter. It does not store any of the statistics of the In-Memory-Database.
The '''ring buffer''' is a packet buffer. It stores raw Ethernet packets on one or many '''storage devices'''. A '''storage device''' is an internal or external HDD or SSD. If the buffer is full, it will overwrite the oldest packets in a circular manner. The '''ring buffer''' is an optional feature for the Allegro Network Multimeter. It does not store any of the statistics of the In-Memory-Database.


Allegro recommend to take a look at the [https://allegro-packets.com/en/resources-service/whitepaper/whitepaper-paket-ring-buffer| Ring Buffer White Paper] from the Allegro Packets website.
Allegro recommend you to take a look at the [https://allegro-packets.com/en/resources-service/whitepaper/whitepaper-paket-ring-buffer ring buffer White Paper] from the Allegro Packets website.


The '''Webshark''' and the '''Pcap''' extraction works with historic dates as in the screenshot here on the right. This dialogue is shown by using the '''Pcap''' button in the Allegro User Interface. The Allegro Network Multimeter will search for all packets in the '''Ring Buffer''' if they match the criteria and extracts the packets.  
The '''Webshark''' and the '''pcap''' extraction works with historic dates as in the screenshot here on the right. This dialogue is shown by using the '''pcap''' button in the Allegro User Interface. The Allegro Network Multimeter will search for all packets in the '''ring buffer''' if they match the criteria and extracts the packets.  


If there is no '''Ring Buffer''' configured, the Allegro allows a '''Pcap''' extraction of live traffic only.
If there is no '''ring buffer''' configured, the Allegro Network Multimeter allows a '''pcap''' extraction of live traffic only.


== Different '''Ring Buffer''' Modes ==
== Different '''ring buffer''' storages ==


The '''Ring Buffer''' supports 2 different modes.  
The '''Packet Ring Buffer''' supports 2 different way to add storage space.  
The '''Single Shared Ring Buffer''' can be used if you need only one Ring Buffer that fits into your storage device. The '''Single Shared Ring Buffer''' uses '''one''' shared storage for the '''Ring Buffer''' and '''Pcap to Disk'''. This mode is recommended if only one storage device is used since it allows a '''Ring Buffer''' and space for '''Pcap files''' on the same storage device. Please note that using both features at the same time may lead to a performance bottleneck.
Storage space can be allocated on active storage devices to share the space of a storage device between the Packet Ring Buffer and e.g. capture PCAPs on the storage device. If multiple Packet Ring Buffers are used they can allocate space on the same storage device. This is only recommended with fast storage devices like SSDs.


The '''Cluster Ring Buffer''' mode allows to use multiple Ring Buffers where each Ring Buffer can have multiple disks. It allows having a separate disk for Pcap files which allows fast '''Ring Buffer''' and fast '''Pcap to disk''' writes at the same time.
The '''Packet Ring Buffer''' also allows to add one or multiple whole disks. It allows having a separate disk for pcap files which allows fast '''ring buffer''' and fast '''pcap to disk''' writes at the same time.


== '''Single Shared Ring Buffer''' ==
== '''Single shared ring buffer''' ==


The Single Shared Ring Buffer the default setup on all Allegro Network Multimeters that are shipped with '''one''' internal or external storage device. This mode is designed for '''ONE''' internal, external or iSCSI storage device. ( Please see the section [[#iSCSI Ring Buffer]] for more information ). It does not allow you to use multiple Ring Buffers with one Allegro Network Multimeter. You can check at '''Generic''' → '''Storage''' if the Allegro Network Multimeter has detected a storage device. Here an example of ONE attached disk:
The single shared ring buffer is the default setup on all Allegro Network Multimeters that are shipped with '''one''' internal or external storage device. This is designed for using '''ONE''' internal, external or iSCSI storage device. ( Please see the section [[#iSCSI ring buffer|iSCSI ring buffer]] for more information ). You can check at '''Generic''' → '''Storage''' if the Allegro Network Multimeter has detected a storage device. Here an example of ONE attached disk:


[[File:Storage no device active.png|border|600px]]
[[File:Storage no device active.png|border|600px]]


You can activate and deactivate the storage device for Pcap files here. You can also format new disks by using the format option and erase the content of a disk if required. If the disk has not been formatted before, press the ''Format'' Button here. It will show the dialogue:
You can activate and deactivate the storage device for pcap files here. You can also format new disks by using the format option and erase the content of a disk if required. If the disk has not been formatted before, press the ''Format'' button here. It will show the dialogue:


[[File:Format disk dialogue.png|border|300px]]
[[File:Format disk dialogue.png|border|300px]]


Here you can decide whether disk encryption will be used or not, see [[#Encryption]] below. You can also decide if and how much space can be used for the '''Packet Ring Buffer'''. Please note that you cannot save any Pcap files to the external disk when you use '''100 %''' for the '''Ring Buffer'''.
Here you can decide whether disk encryption will be used or not, see [[#Encryption|Encryption]] below. You can also decide if and how much space can be used for the '''packet ring buffer'''. Please note that you cannot save any pcap files to the external disk when you use '''100 %''' for the '''ring buffer'''.


If the disk has been formatted, you can continue with the configuration of the '''Ring Buffer''' at '''Generic'''  → '''Ring Buffer'''. If you have created a disk with a Ring Buffer, you should see the statistics of the Buffer as in the screen shot here below.
If the disk has been formatted, you can continue with the configuration of the '''ring buffer''' at '''Generic'''  → '''ring buffer'''. If you have created a disk with a ring buffer, you should see the statistics of the buffer as in the screenshot here below.


[[File:Running packet ring buffer.png|600px]]
[[File:Running packet ring buffer.png|border|600px]]


The Ring Buffer is now running and all Pcap buttons will work for historic dates. For advanced setup, please continue at the section [[#Filter Rules]].
The ring buffer is now running and all pcap buttons will work for historic dates. For advanced setup, please continue at the section [[#Filter Rules|Filter Rules]].


== '''Cluster Ring Buffer''' ==
== '''Packet Ring Buffer with multiple disks''' ==


The Cluster Ring Buffer is the default mode on all Allegro Network Multimeters that are shipped with '''two or more''' internal or external storage devices.
The Packet Ring Buffer with multiple disks is active on all Allegro Network Multimeters that are shipped with '''two or more''' internal or external storage devices.


By default, the Allegro Network Multimeter uses '''One''' Cluster Ring Buffer. If you need more, please open the Settings Menu at the top right corner.
By default, the Allegro Network Multimeter uses '''One''' Packet Ring Buffer. If you need more, please open the Settings menu at the top right corner.


[[File:Settings button.png|100px]]
[[File:Settings button.png|border|100px]]


Here you can increase the number of Cluster Ring Buffers. We will continue this tutorial with 2 Ring Buffers to show the full flexibility of the Allegro. Please note that you need to restart the processing when you change the parameter. This can be done at '''Settings''' → '''Administration''' → '''Restart processing'''.
Here you can increase the number of Packet Ring Buffers. We will continue this tutorial with 2 Packet Ring Buffers to show the full flexibility of the Allegro Network Multimeter. Please note that you need to restart the processing when you change the parameter. This can be done at '''Settings''' → '''Administration''' → '''Restart processing'''.
 
To enable the Cluster Ring Buffer mode, please check at '''Generic'''  → '''Ring Buffer''', if the tab ''cluster configuration'' is selected or not. If it is not, selected, delete the non-Cluster Ring Buffer with:
 
[[File:Delete ring buffer button.png|100px]]
 
Once this is done, you should see the dialogue:
 
[[File:Select ring buffer.png|300px]]
 
Here you can select '''Create Cluster Ring Buffer'''. Once this is selected, you will see all available Clusters of Ring Buffers. By default, the first Cluster is running but has no disk assigned to it. The size of the Buffer is 0 Bytes and it drops all packets written into it.


[[File:Cluster ring buffer initial startup.png|border|600px]]
[[File:Cluster ring buffer initial startup.png|border|600px]]


As a next step, please select the configuration for the Cluster.
As a next step, please select the configuration for the Packet Ring Buffer.


[[File:Cluster ring buffer configuration.png|border|600px]]
[[File:Cluster ring buffer configuration.png|border|600px]]


Please select here '''Add to Cluster''' to format a disk and add it to the Cluster. Once you have added disks to a Cluster, the packets will be written to the storage device.
Please select here '''Add to Packet Ring Buffer''' to format a disk and add it to the Packet Ring Buffer. Once you have added disks to a Packet Ring Buffer, the packets will be written to the storage device.


[[File:Cluster ring buffer with disks.png|border|600px]]
[[File:Cluster ring buffer with disks.png|border|600px]]
Line 69: Line 59:
== Filter Rules ==
== Filter Rules ==


Both Ring Buffer modes support packet filtering mechanisms. Most situations require that only a subset of all packets are stored to the disk. Each Ring Buffer can be configured by a separate list of rules. All packet that do not match a condition are captured. The first matching condition is applied to the packets.
Both ring buffer modes support packet filtering mechanisms. Most situations require that only a subset of all packets are stored to the disk. Each ring buffer can be configured by a separate list of rules. All packets that do not match a condition are captured. The first matching condition is applied to the packets.


=== Filter rule conditions ===
=== Filter rule conditions ===
Line 75: Line 65:
The Allegro Network Multimeter supports packet slicing with the following conditions:
The Allegro Network Multimeter supports packet slicing with the following conditions:


* All packets → matches on all Ehternet packets
* All packets → matches on all Ethernet packets
* MAC address → matches a specific L2 MAC address
* MAC address → matches a specific L2 MAC address
* IP Address and IP Subnet → matches a specific IP address and Subnet, works for IPv4 and IPv6
* IP Address and IP Subnet → matches a specific IP address and subnet, works for IPv4 and IPv6
* TCP/UDP Ports → matches all TCP or UDP packets with a specific source or destination port
* TCP/UDP Ports → matches all TCP or UDP packets with a specific source or destination port
* L7 Protocol → matches one of the built-in L7 Protocols
* L7 Protocol → matches one of the built-in L7 protocols
* Outer VLAN Tag → matches a single VLAN tag or the outer VLAN of a double-tagged VLAN frame
* Outer VLAN Tag → matches a single VLAN tag or the outer VLAN of a double-tagged VLAN frame. It is also possible to match packets that have no VLAN tag at all by choosing 'no VLAN' from the drop-down menu or match packets with an arbitrary VLAN tag by choosing 'any VLAN' form the drop-down menu
* Interface → matches a specific network interface
* Interface → matches a specific network interface
* SIP Phone Number → matches a specific SIP caller or callee phone number and its correlated RTP flow
* SIP Phone Number → matches a specific SIP caller or callee phone number and its correlated RTP flow
* Virtual Link Group → matches a virtual link group
* Virtual Link Group → matches a virtual link group
* IP group → matches an IP group
* SSL after handshake → matches packets of SSL connections that occur after the SSL handshake


All conditions can be negated to match everything except an IP subnet and similar.
All conditions can be negated to match everything except an IP subnet and similar.
Line 91: Line 83:
The following items are supported as actions:
The following items are supported as actions:


* Snapshot Length → byte packet slicing; allows for the capture of only a certain number of bytes per packet.
* Snapshot Length → byte packet slicing; allows for the capture of only a certain number of bytes per packet
* Discard → do not capture this packet
* Discard → do not capture this packet
* Full → capture the full packet
* Full → capture the full packet
* Header+Data → capture only up to L3 or L4 or a specified amount of L7 bytes.
* Header+Data → capture only up to L3 or L4 or a specified quantity of L7 bytes.


=== Filter rule examples ===
=== Filter rule examples ===


Filter rules can be set up below the statistics of each Ring Buffer. This is a list of the most-used filter rules. Please note that you can combine these rules.  
Filter rules can be set up below the statistics of each ring buffer. This is a list of the most-used filter rules. Note that you can combine these rules.  


==== Capture all traffic from and to a single IP ====
==== Capture all traffic from and to a single IP ====


This use case is valid when you need to investigate the packets of one IP but you need the statistics of the total link. This is a very common use case where the link bandwidth is above the Ring Buffer write rate. As an example, it can occur when you monitor a heavy loaded 10G or 40G link with a single HDD as the Ring Buffer device.
This use case is valid when you need to investigate the packets of one IP but you need the statistics of the total link. This is a common use case where the link bandwidth is above the ring buffer write rate. As an example, it can occur when you monitor a heavy loaded 10G or 40G link with a single HDD as the ring buffer device.


You need to set up 2 rules to capture only one single IP. The first rule matches the IP address and captures the entire payload, the second rule drops all packets. This will also drop all non-IP packets like ARP requests.
You need to set up 2 rules to capture only one single IP. The first rule matches the IP address and captures the entire payload, the second rule drops all packets. This will also drop all non-IP packets like ARP requests.
Line 108: Line 100:
[[File:Ring buffer filter one ip.png|border|600px]]
[[File:Ring buffer filter one ip.png|border|600px]]


==== Capture SSL traffic only until L4 ====
==== Capture only the handshake of SSL traffic and limit the encrypted part to L4 ====


Also a common use case is to not capture encrypted content. This can be done by setting up a rule for encrypted L7 protocols to capture only up to the L4 header for IP and TCP investigation. This can be configured with the following settings:
Also a common use case is to not capture encrypted content. This can be done by setting up a rule for SSL after handshake packets to capture only up to the L4 header for IP and TCP investigation. This can be configured with the following settings:


[[File:Ring buffer rule create ssl l4.png|400px]]
[[File:Ring buffer rule create ssl after handshake.png|alt=|border|399x399px]]


The configured rule will look like:
The configured rule will look like:


[[File:Ring buffer rule ssl l4.png|border|600px]]
[[File:Ring buffer rule ssl after handshake.png|alt=|border|600x600px]]


==== Capture full SIP, capture RTP to the first 12 bytes of the payload and drop all other packets ====
==== Capture full SIP, capture RTP to the first 12 bytes of the payload and drop all other packets ====
Line 123: Line 115:


[[File:Ring buffer rule sip rtp.png|border|600px]]
[[File:Ring buffer rule sip rtp.png|border|600px]]
==== Capture all packets except SIP and RTP ====
This use case is very common for all environments where no voice is allowed to be captured. Here is the example rule setup:
[[File:Ring buffer rule drop sip rtp.png|600px]]


== Performance ==
== Performance ==


=== Disk write and read performance ===
=== Disk read and write performance ===


Please note that one disk can have '''one''' shared Ring Buffer or be part of '''one''' Cluster Ring Buffer. Hard disk drives have a very high constant write rate when only one write is active.
Hard disk drives have a high constant write rate when only one write is active.


The Allegro Network Multimeter has a ''write first'' policy on the Ring Buffer devices.  When extracting a Pcap file from the Ring Buffer wh
The Allegro Network Multimeter has a ''write first'' policy on the ring buffer devices.  The Allegro Network Multimeter prioritizes writes over reads for storage. A pcap read can be very slow when there is a high write rate to the ring buffer.


=== Concurrent '''Ring Buffer''' and live '''Pcap''' recording ===
=== Concurrent '''ring buffer''' and live '''pcap''' recording ===


Please note that HDDs are not made for 2 simultaneous write streams. The write rate will be very low if you capture a live Pcap to the single shared storage device while having an active ring buffer. Please use the browser download feature, different disks with the cluster ring buffer or pause the ring buffer while capturing the live Pcap.
Note that HDDs are not made for 2 simultaneous write streams. The write rate will be very low if you capture a live pcap to the single shared storage device while having an active ring buffer. Please use the browser download feature, different disks with the Packet Ring Buffer or pause the ring buffer while capturing the live pcap.


=== Buffering traffic peaks or disk slowdowns ===
=== Buffering traffic peaks or disk slowdowns ===


Please note that most HDDs and SSDs do not have a guaranteed write rate. Especially HDDs via the USB or SATA3 protocol can have down-times of hundreds of milliseconds between writes. The buffer these downtimes, each ring buffer has a certain amount of memory to buffer traffic peaks. This buffer can be configured at the '''Settings''' of the '''Ring Buffer'''
Note that most HDDs and SSDs do not have a guaranteed write rate. Especially HDDs via the USB or SATA3 protocol can have downtimes of hundreds of milliseconds between writes. Each ring buffer uses a certain amount of memory to buffer traffic peaks. This buffer can be configured at the '''Settings''' of the '''ring buffer'''.


[[File:Ring buffer queue resize config.png|border|800px]]
[[File:Ring buffer queue resize config.png|border|800px]]


You can check if the queue length is big enough with the '''Bytes in Flight''' graph and the '''Dropped Bytes''' graph in the ring buffer statistics.
You can check if the queue length is large enough with the '''Bytes in Flight''' graph and the '''Dropped Bytes''' graph in the ring buffer statistics.


[[File:Ring buffer data in flight.png|border|800px]]
[[File:Ring buffer data in flight.png|border|800px]]


== iSCSI Ring Buffer ==
== iSCSI ring buffer ==


'''''DISCLAIMER''' Whenever possible, use a direct-connected exclusive external storage device via USB. The Allegro Network Multimeter can control the USB channel far better than an iSCSI channel due exclusivity.''
'''''DISCLAIMER''' Whenever possible, use a direct-connected exclusive external storage device via USB. The Allegro Network Multimeter can control the USB channel far better than an iSCSI channel due to exclusivity.''


The iSCSI Ring Buffer feature allows to mount an iSCSI volume via the management interface. Allegro recommends to use this feature only for capture rates up to 1GBit/s. The iSCSI controller shall have an exclusive low-latency connection to the Allegro Network Multimeter and the volume shall be exclusive for the Allegro Network Multimeter. Also the management traffic between the Allegro and the iSCSI volume shall not be monitored by the Allegro to prevent a write loop.
The iSCSI ring buffer feature allows you to mount an iSCSI volume via the management interface. Allegro recommends to use this feature only for capture rates up to 1GBit/s. The iSCSI controller will have an exclusive low-latency connection to the Allegro Network Multimeter and the rate shall be exclusive to the Allegro Network Multimeter. Also, the management traffic between the Allegro Network Multimeter and the iSCSI rate will not be monitored by the Allegro Network Multimeter to prevent a write loop.
If the volume is non-exclusive, other reads or writes will heavily reduce the constant write rate. Please note that the iSCSI connection is not encrypted.
If the rate is non-exclusive, other reads or writes will heavily reduce the constant write rate. Note that the iSCSI connection is not encrypted.


== Advanced Options ==
== Advanced Options ==
Line 162: Line 160:


The Allegro Network Multimeter uses an '''AES256 LUKS encryption container''' for encrypted single shared ring buffers. You can connect and mount the encrypted disk with many Linux Distributions. It will ask for your password to mount the container.
The Allegro Network Multimeter uses an '''AES256 LUKS encryption container''' for encrypted single shared ring buffers. You can connect and mount the encrypted disk with many Linux Distributions. It will ask for your password to mount the container.
The Allegro uses hardware encryption if available. The Allegro 200 does not have HW encryption support and can encrypt up to 400MBit/s in software. All other Allegro devices can encrypt with 2GB/s by using the built-in hardware encryption.
The Allegro Network Multimeter uses hardware encryption if available. The Allegro 200 does not have HW encryption support and can encrypt up to 400MBit/s in software. All other Allegro devices can encrypt with 2GB/s by using the built-in hardware encryption.
 
The Allegro Network Multimeter does ''not'' store the password of the encrypted device on the disk. you need to re-enter the password if you unmount, reboot or power-off the Allegro Network Multimeter.
 
The encryption is not available when entire disks are used in the Packet Ring Buffer.


The Allegro does ''not'' store the password of the encrypted device on the disk. you need to re-enter the password if you unmount, reboot or power-off the Allegro Network Multimeter.
==== Random, device specific passwords ====


The encryption is not available for the Cluster Ring buffer.
Randomly generated password can be used for the encrypted storage device. When used, the storage can be activated and deactivated without entering the password. Also, the storage device is automatically activated on system start/restart.
The password is stored encrypted on the device and cannot be moved to a different device. The password is also deleted on a configuration reset of the Allegro Network Multimeter.
Since the password is stored on the Allegro Network Multimeter, the storage device cannot be used on a different Allegro Network Multimeter without reformatting.
When the key is removed (on configuration reset or reformat), it cannot be restored!

Latest revision as of 12:17, 18 September 2024

This section describes the ring buffer configuration and options for the Allegro Network Multimeter.

What is the ring buffer?

Historic capture dialog.png

The ring buffer is a packet buffer. It stores raw Ethernet packets on one or many storage devices. A storage device is an internal or external HDD or SSD. If the buffer is full, it will overwrite the oldest packets in a circular manner. The ring buffer is an optional feature for the Allegro Network Multimeter. It does not store any of the statistics of the In-Memory-Database.

Allegro recommend you to take a look at the ring buffer White Paper from the Allegro Packets website.

The Webshark and the pcap extraction works with historic dates as in the screenshot here on the right. This dialogue is shown by using the pcap button in the Allegro User Interface. The Allegro Network Multimeter will search for all packets in the ring buffer if they match the criteria and extracts the packets.

If there is no ring buffer configured, the Allegro Network Multimeter allows a pcap extraction of live traffic only.

Different ring buffer storages

The Packet Ring Buffer supports 2 different way to add storage space. Storage space can be allocated on active storage devices to share the space of a storage device between the Packet Ring Buffer and e.g. capture PCAPs on the storage device. If multiple Packet Ring Buffers are used they can allocate space on the same storage device. This is only recommended with fast storage devices like SSDs.

The Packet Ring Buffer also allows to add one or multiple whole disks. It allows having a separate disk for pcap files which allows fast ring buffer and fast pcap to disk writes at the same time.

Single shared ring buffer

The single shared ring buffer is the default setup on all Allegro Network Multimeters that are shipped with one internal or external storage device. This is designed for using ONE internal, external or iSCSI storage device. ( Please see the section iSCSI ring buffer for more information ). You can check at Generic → Storage if the Allegro Network Multimeter has detected a storage device. Here an example of ONE attached disk:

Storage no device active.png

You can activate and deactivate the storage device for pcap files here. You can also format new disks by using the format option and erase the content of a disk if required. If the disk has not been formatted before, press the Format button here. It will show the dialogue:

Format disk dialogue.png

Here you can decide whether disk encryption will be used or not, see Encryption below. You can also decide if and how much space can be used for the packet ring buffer. Please note that you cannot save any pcap files to the external disk when you use 100 % for the ring buffer.

If the disk has been formatted, you can continue with the configuration of the ring buffer at Generic → ring buffer. If you have created a disk with a ring buffer, you should see the statistics of the buffer as in the screenshot here below.

Running packet ring buffer.png

The ring buffer is now running and all pcap buttons will work for historic dates. For advanced setup, please continue at the section Filter Rules.

Packet Ring Buffer with multiple disks

The Packet Ring Buffer with multiple disks is active on all Allegro Network Multimeters that are shipped with two or more internal or external storage devices.

By default, the Allegro Network Multimeter uses One Packet Ring Buffer. If you need more, please open the Settings menu at the top right corner.

Settings button.png

Here you can increase the number of Packet Ring Buffers. We will continue this tutorial with 2 Packet Ring Buffers to show the full flexibility of the Allegro Network Multimeter. Please note that you need to restart the processing when you change the parameter. This can be done at Settings → Administration → Restart processing.

Cluster ring buffer initial startup.png

As a next step, please select the configuration for the Packet Ring Buffer.

Cluster ring buffer configuration.png

Please select here Add to Packet Ring Buffer to format a disk and add it to the Packet Ring Buffer. Once you have added disks to a Packet Ring Buffer, the packets will be written to the storage device.

Cluster ring buffer with disks.png

Filter Rules

Both ring buffer modes support packet filtering mechanisms. Most situations require that only a subset of all packets are stored to the disk. Each ring buffer can be configured by a separate list of rules. All packets that do not match a condition are captured. The first matching condition is applied to the packets.

Filter rule conditions

The Allegro Network Multimeter supports packet slicing with the following conditions:

  • All packets → matches on all Ethernet packets
  • MAC address → matches a specific L2 MAC address
  • IP Address and IP Subnet → matches a specific IP address and subnet, works for IPv4 and IPv6
  • TCP/UDP Ports → matches all TCP or UDP packets with a specific source or destination port
  • L7 Protocol → matches one of the built-in L7 protocols
  • Outer VLAN Tag → matches a single VLAN tag or the outer VLAN of a double-tagged VLAN frame. It is also possible to match packets that have no VLAN tag at all by choosing 'no VLAN' from the drop-down menu or match packets with an arbitrary VLAN tag by choosing 'any VLAN' form the drop-down menu
  • Interface → matches a specific network interface
  • SIP Phone Number → matches a specific SIP caller or callee phone number and its correlated RTP flow
  • Virtual Link Group → matches a virtual link group
  • IP group → matches an IP group
  • SSL after handshake → matches packets of SSL connections that occur after the SSL handshake

All conditions can be negated to match everything except an IP subnet and similar.

Filter rule actions

The following items are supported as actions:

  • Snapshot Length → byte packet slicing; allows for the capture of only a certain number of bytes per packet
  • Discard → do not capture this packet
  • Full → capture the full packet
  • Header+Data → capture only up to L3 or L4 or a specified quantity of L7 bytes.

Filter rule examples

Filter rules can be set up below the statistics of each ring buffer. This is a list of the most-used filter rules. Note that you can combine these rules.

Capture all traffic from and to a single IP

This use case is valid when you need to investigate the packets of one IP but you need the statistics of the total link. This is a common use case where the link bandwidth is above the ring buffer write rate. As an example, it can occur when you monitor a heavy loaded 10G or 40G link with a single HDD as the ring buffer device.

You need to set up 2 rules to capture only one single IP. The first rule matches the IP address and captures the entire payload, the second rule drops all packets. This will also drop all non-IP packets like ARP requests.

Ring buffer filter one ip.png

Capture only the handshake of SSL traffic and limit the encrypted part to L4

Also a common use case is to not capture encrypted content. This can be done by setting up a rule for SSL after handshake packets to capture only up to the L4 header for IP and TCP investigation. This can be configured with the following settings:

The configured rule will look like:

Capture full SIP, capture RTP to the first 12 bytes of the payload and drop all other packets

This is a common VoIP use case where you are allowed to capture the signaling traffic and the RTP header ( 12 bytes ) but not the RTP traffic payload. Here is the example rule setup:

Ring buffer rule sip rtp.png

Capture all packets except SIP and RTP

This use case is very common for all environments where no voice is allowed to be captured. Here is the example rule setup:

Ring buffer rule drop sip rtp.png

Performance

Disk read and write performance

Hard disk drives have a high constant write rate when only one write is active.

The Allegro Network Multimeter has a write first policy on the ring buffer devices. The Allegro Network Multimeter prioritizes writes over reads for storage. A pcap read can be very slow when there is a high write rate to the ring buffer.

Concurrent ring buffer and live pcap recording

Note that HDDs are not made for 2 simultaneous write streams. The write rate will be very low if you capture a live pcap to the single shared storage device while having an active ring buffer. Please use the browser download feature, different disks with the Packet Ring Buffer or pause the ring buffer while capturing the live pcap.

Buffering traffic peaks or disk slowdowns

Note that most HDDs and SSDs do not have a guaranteed write rate. Especially HDDs via the USB or SATA3 protocol can have downtimes of hundreds of milliseconds between writes. Each ring buffer uses a certain amount of memory to buffer traffic peaks. This buffer can be configured at the Settings of the ring buffer.

Ring buffer queue resize config.png

You can check if the queue length is large enough with the Bytes in Flight graph and the Dropped Bytes graph in the ring buffer statistics.

Ring buffer data in flight.png

iSCSI ring buffer

DISCLAIMER Whenever possible, use a direct-connected exclusive external storage device via USB. The Allegro Network Multimeter can control the USB channel far better than an iSCSI channel due to exclusivity.

The iSCSI ring buffer feature allows you to mount an iSCSI volume via the management interface. Allegro recommends to use this feature only for capture rates up to 1GBit/s. The iSCSI controller will have an exclusive low-latency connection to the Allegro Network Multimeter and the rate shall be exclusive to the Allegro Network Multimeter. Also, the management traffic between the Allegro Network Multimeter and the iSCSI rate will not be monitored by the Allegro Network Multimeter to prevent a write loop. If the rate is non-exclusive, other reads or writes will heavily reduce the constant write rate. Note that the iSCSI connection is not encrypted.

Advanced Options

Disk format

The Allegro Network Multimeter uses EXT4 for all formatted file systems for the ring buffer. EXT4 file systems support advanced features that are mandatory to capture with full SSD speed.

Encryption

The Allegro Network Multimeter uses an AES256 LUKS encryption container for encrypted single shared ring buffers. You can connect and mount the encrypted disk with many Linux Distributions. It will ask for your password to mount the container. The Allegro Network Multimeter uses hardware encryption if available. The Allegro 200 does not have HW encryption support and can encrypt up to 400MBit/s in software. All other Allegro devices can encrypt with 2GB/s by using the built-in hardware encryption.

The Allegro Network Multimeter does not store the password of the encrypted device on the disk. you need to re-enter the password if you unmount, reboot or power-off the Allegro Network Multimeter.

The encryption is not available when entire disks are used in the Packet Ring Buffer.

Random, device specific passwords

Randomly generated password can be used for the encrypted storage device. When used, the storage can be activated and deactivated without entering the password. Also, the storage device is automatically activated on system start/restart. The password is stored encrypted on the device and cannot be moved to a different device. The password is also deleted on a configuration reset of the Allegro Network Multimeter. Since the password is stored on the Allegro Network Multimeter, the storage device cannot be used on a different Allegro Network Multimeter without reformatting. When the key is removed (on configuration reset or reformat), it cannot be restored!

Retrieved from "https://allegro-packets.com/wiki/index.php?title=Ring_Buffer_Configuration_Guide&oldid=4864"