Flow Capture; Limitations; The Flow Capture Process - Cisco SCE2020-4XGBE-SM Configuration Manual

Flow Capture

Flow Capture
•
•
The flow capture utility is a CLI-controlled utility used to capture traffic according to layer 4 attributes.
Traffic captured by this utility is accumulated in a cap format file. Traffic that is identified by the capture
mechanism is not available for traffic control or any service for the duration of the capture. At the
completion of the capture, the normal service to all traffic is resumed.
The recorded data is sent online to a distant location using FTP. The data is sent in a standard format and
may have an unlimited size on the SCE 2000.

Limitations

Note the following known limitations of the flow capture utility:
•
•
•
•

The Flow Capture Process

There are three main steps in the overall flow capture process:
1.
2.
3.
Cisco SCE 2000 and SCE 1000 Software Configuration Guide
4-12
Limitations, page 4-12
The Flow Capture Process, page 4-12
The actual capture starts only for newly opened flows. Therefore, already opened flows cannot be
captured by this utility.
The termination of a capture flow is verified for every new relevant packet that is being captured.
As long as no packets matching the capturing attributes arrives after the time is exceeded, the
capturing is not stopped and must be stopped manually.
Capture may end prematurely due to a shortage event on the SCE platform.
Capturing throughput is limited by the following:
– system architectural limitations
– line capacity to the remote FTP destination (for non-Linux platforms only, such as the SCE 2000
platform).
The approximated throughput on a live setup is 2Mbps. When this throughput is exceeded, packets
are absent from the cap file and the appropriate field in the consequent captured packet is updated
to note the number of lost packets. The maximum allowed number of sequential lost packets is
configurable by a const DB.
Configure the traffic rules to define the traffic to be captured.
Rule, page 4-13)
Configure the flow capture settings. (Optional)
Perform the actual flow capture.
(Configuring the Flow Capture Settings, page
(Performing the Flow Capture, page
Chapter 4
(Configuring a Flow Capture Traffic
4-14)
Utilities
4-13)
OL-7827-12