Ring Buffer Configuration Guide

This section describes the Ring Buffer configuration and options for the Allegro Network Multimeter.

What is the Ring Buffer

The Ring Buffer is a packet buffer. It stores raw Ethernet packets on one or many storage devices. A storage device is an internal or external HDD or SSD. If the buffer is full, it will overwrite the oldest packets as in a circular manner. The Ring Buffer is an optional feature for the Allegro Network Multimeter. It does not store any of the statistics of the In-Memory-Database.

Allegro recommend to take a look at the ring buffer white paper from the Allegro Packets website.

The Webshark and the Pcap extraction works with historic dates as in the screen shot here on the right. This dialog is shown by using the Pcap button in the Allegro. The Allegro Network Multimeter will search for all packets in the Ring Buffer if they match the criteria and extract the packets.

If there is no Ring Buffer configured, the Allegro allows a Pcap extraction of live traffic only.

Different Ring Buffer modes

The Ring Buffer support 2 different modes. The Single Shared Ring Buffer can be used if you need only one Ring Buffer that fits into your storage device. The Single Shared Ring Buffer uses one shared storage for the Ring Buffer and Pcap to Disk. This mode is recommended if only one storage device is used as it allows a Ring Buffer and space for Pcap files on the same storage. Please note that using both features at the same time might lead to a performance bottleneck.

The Cluster Ring Buffer mode allows to use multiple Ring Buffers where each Ring Buffer can have multiple disks. It allows having a separate disk for Pcap files which allows fast Ring Buffer and fast Pcap to Disk writes at the same time.

Single Shared Ring Buffer

The Single Shared Ring Buffer the default setup on all Allegro Network Multimeters that are shipped with one internal or external storage. This mode is designed for ONE an internal or external storage. It does not allow to use multiple ring buffers with one Allegro Network Multimeter. You can check at Generic → Storage if the Allegro Network Multimeter has detected a storage. Here an example of ONE attached disk:

You can activate and deactivate the storage for Pcap files here. You can also format new disks by using the format option and erase the content of a disk if required. If the disk has not been formatted before, press the Format Button here. It will show you the dialogue:

Here you can decide whether the disk encryption will be used or not, see #Limitations below. You can also decide if and how much space shall be used for the Packet Ring Buffer. Please note that you cannot save any Pcap files to the external disk when you use 100 % for the Ring Buffer.

If the disk has been formatted, you can continue with the configuration of the Ring Buffer at Generic → Ring Buffer.

The Ring Buffer is now running and all Pcap buttons will work for historic dates. For advanced setup, please continue at the section #Filter Rules.

Cluster Ring Buffer

The Cluster Ring Buffer the default mode on all Allegro Network Multimeters that are shipped with two or more internal or external storages.

By default, the Allegro Network Multimeter uses One Cluster Ring Buffer. If you need more, please open the Settings Menu at the top right corner.

Here you can increase the number of cluster ring buffer.

To enable the Cluster Ring Buffer mode, please check at Generic → Ring Buffer, if the tab cluster configuration is selected or not. If it is not, selected, delete the non-cluster ring buffer with:

Once this is done, you should see the dialogue:

Here you can select Create Cluster Ring Buffer.

This

Limitations

Please note that the Allegro Network Multimeter supports only EXT4 formatted disks for the Ring

ISCSI

disk encryption