Table of Contents
Advertisement
Chapter 4
Utilities
Configuring a Flow Capture Traffic Rule
The flow capture traffic rules define the traffic to be captured. You can configure a flow capture traffic
rule by specifying the flow-capture action for the relevant flows.
For example, in order to capture all the traffic sent to or coming from subscribers whose IP addresses
are in the range.2.3.0-1.2.3.255, define a traffic rule as follows:
SCE(config if)# traffic-rule name flowcapturerule IP-addresses subscriber-side 1.2.3.0/24
network-side all protocol all direction both traffic-counter none action flow-capture
Multiple rules can be configured, but note that all configured flow capture rules are in effect during the
flow capture process. It is not possible to apply only a subset of the configured rules.
For more information regarding configuring traffic rules, see
page
Configuring the Flow Capture Settings
The flow capture settings control aspects of the flow capture process, as opposed to defining the flow to
be captured. These settings limit the scope of the process to maximize the recorded information while
minimizing the effect on traffic.
•
•
OL-7827-12
6-17.
Maximum duration of the capture: By limiting the duration of the capture, you can limit the effect
of the capture on live traffic.
You can stop the capture at any time before the maximum duration has been reached.
Maximum length of the L4 payload of each captured packet: If you want to capture mainly the L2-L4
headers, you need only a small portion of the payload of each packet. Setting a limit on the length
of the payload makes the capture more efficient, as it allows more packets to be captured within a
given time frame and for a given throughput.
Guidelines and Information:
If maximum L4 payload length is not configured, all bytes of each captured packet are recorded.
–
–
If maximum L4 payload length is configured, each captured packet will contain the entireL2/
L3/L4 headers and no more than the configured maximum bytes of L4 payload.
Only one maximum L4 payload length value can be configured. This value applies to all
–
recorded packets.
If the maximum L4 payload length value is changed while recording is performed, it will not
–
take effect until the next recording session.
The cap file contains marking for packets which had TCP or UDP checksum error when
–
received in the SCE platform, since the validity of the TCP and UDP checksum cannot be
checked for the captured packets due to missing bytes.
The cap file contains the information to retrieve the original length of each packet that was
–
truncated.
Configuring Traffic Rules and Counters,
Cisco SCE 2000 and SCE 1000 Software Configuration Guide
Flow Capture
4-13
Advertisement
Table of Contents
