inactive
369
edits
Ring Buffer Configuration Guide: Difference between revisions
m
→Capture SSL traffic only until L4
| Line 110: | Line 110: | ||
==== Capture SSL traffic only until L4 ==== | ==== Capture SSL traffic only until L4 ==== | ||
Also a | Also a common use case is to not capture encrypted content. This can be done by setting up a rule for encrypted L7 protocols to capture only up to the L4 header for IP and TCP investigation. This can be configured with the following settings: | ||
[[File:Ring buffer rule create ssl l4.png|400px]] | [[File:Ring buffer rule create ssl l4.png|400px]] | ||
| Line 117: | Line 117: | ||
[[File:Ring buffer rule ssl l4.png|border|600px]] | [[File:Ring buffer rule ssl l4.png|border|600px]] | ||
==== Capture full SIP, capture RTP to the first 12 bytes of the payload and drop all other packets ==== | ==== Capture full SIP, capture RTP to the first 12 bytes of the payload and drop all other packets ==== | ||