Usage¶
In order to save all the traffic into disks, the n2disk application has to be activated on an interface from which it is possible to capture all the traffic you are interested in. Once activated, n2disk will save the traffic data into the specified directory recycling the files already written, starting from the oldest one, this in case the maximum number of created files is reached.
In the following sections, we discuss all the n2disk command line options and how to efficiently configure n2disk to capture all the traffic flowing in your network.
Command Line Options¶
Below the available options and a detailed explanation of each option are listed:
CAPTURE SETTINGS
[--interface|-i] <device> | Ingress packet device.
[--active-wait|-g] | Active packet polling.
[--poll-duration|-q] <duration> | Poll duration (usec). Lower more CPU is used,
| better response time. Default: 1 usec.
[--snaplen|-s] <len> | Max packet capture length. Default: 1536.
[--packet-slicing] <header level> | Slice packet after the specified header.
[--strip-header-bytes|-Y] <len> | Strip the specified number of bytes from packet header.
[--sample-rate|-y] <rate> | Packet sample rate (e.g. 100 means 1:100 sampling).
[--capture-direction|-2] <dir> | Capture direction: 0=RX+TX, 1=RX only (default), 2=TX only
[--not-promisc|-3] | Do not set the interface in promiscuous mode.
[--dump-fcs] | Dump the Frame Check Sequence (FCS/CRC)
FILTERING
[--filter|-f] <filter> | BPF (tcpdump-like) ingress packet filter.
[--fast-filter|-F] <filter> | Faster replacement for BPF ingress packet filter.
[--l7-filter-conf] <conf file> | FT configuration file for L7 filtering.
TIMESTAMPING
[--hw-timestamp|-J] <mode> | Hardware timestamp packet strip. Supported modes:
| ixia - Timestamped packets by ixiacom.com hardware devices
| arista - Timestamped packets by Arista 7150 series devices.\n"
| ixia - Timestamped packets by ixiacom.com hardware devices.\n"
| metawatch - Timestamped packets by Arista Metawatch devices.\n");
| NOTE: Silicom Hw TS NICs are supported automatically.
[--time-pulse|-S <id>] | Enable time pulse thread (optimise sw packet timestamping)
| and bind it to the specified core.
[--nanoseconds|-d] | Dump timestamps in nanosecond format.
[--no-timestamp|-T] | Do not compute timestamps.
DUMP SETTINGS
[--chunk-len|-C] <len> | Size (KB) of the chunk written to disk (must be
| multiple of 4096). Default: 64 KB.
[--journaling|-j] | Enable journaling.
[--buffer-len|-b] <len> | Buffer length (MBytes).
[--dump-directory|-o] <dir> | Directory where dump files will be saved (multiple -o can be specified).
[--archive-directory|-O] <dir> | Directory where dump files will be archived (slower disks).
[--max-file-len|-p] <len> | Max pcap file length (MBytes).
[--max-file-duration|-t] <secs> | Max pcap file duration (sec).
[--max-file-packets|-N] <num> | Max packets per pcap file. Default: 0 (no max duration).
[--disk-limit|-6] <size> | Max amount of disk space to use (MBytes or %).
[--max-num-files|-m] <num> | Max number of files before restarting file name.
[--max-nested-dirs|-n] <num> | Max number of nested dump sub-directories.
[--file-prefix|-x] <prefix> | Dump file prefix.
[--hugepages|-U] | Use hugepages for memory allocation.
[--disable-direct-io|-r] | Disable Direct I/O (experts only).
[--stop-on-limit|-L] | Use max len/duration/packets as limit to stop capture.
[--remove-ahead|-H] | Delete in advance dumped files that will soon be
| overwritten. Use this option to reduce file deletion cost.
[--pcap-compression|-M] | Compress pcap files (produces .npcap compressed files)
INDEX SETTINGS
[--index|-I] | Create pcap-index on-the-fly.
[--timeline-dir|-A] <dir> | Time-arranged directory for produced pcaps and indexes.
[--extended-index|-E] <type> | Extended index type (combinations are allowed using a mask):
| 1 - add per-packet timestamp
| 2 - add L7 protocol (also enabled with --zmq)
[--index-tunnel-content|-G] <m> | Compute index on tunnel content (GTP-U)
| 1 - Index both inner and outer headers
| 2 - Use inner header as outer header
[--index-on-compressor-threads|-Z] | Compute index on the thread(s) used for compression (-z)
| instead of using the capture thread(s).
[--exec-cmd] <cmd> | Execute the specified command when a pcap has been dumped.
CPU AFFINITY
[--reader-cpu-affinity|-c] <id> | Bind the reader thread to the specified core.
[--writer-cpu-affinity|-w] <cores> | Bind the writer thread(s) to the specified core ids.
| A comma-separated list of cores (e.g. 0,1,2,3) should be
| specified in case of multiple dump directories (-o).
[--compressor-cpu-affinity|-z] <ids> | Enable multithread compression and/or indexing and
| bind thread(s) to the specified core ids (e.g. 0,1,2,3)
| (mandatory with indexing on Napatech cards)
MICRO-BURST DETECTION
[--uburst-detection] | Enable microburst detection.
[--uburst-log] | Microbursts log file.
[--uburst-win-size] <usec> | Window size for microburst check.
[--uburst-link-speed] <mbit/s> | Link speed.
[--uburst-threshold] <percent> | Traffic threshold (link speed percentage).
STATS EXPORT
[--zmq <socket>] | Deliver flows/stats to subscribers connected to the specified endpoint.
| Example tcp://*:5556 or ipc://flows.ipc
| Note: probe mode is used, configure ntopng as collector.
[--zmq-encrypt-pwd <pwd>] | Encrypt the ZMQ data using the specified password
[--zmq-encryption-key] <pub key>] | Encrypt ZMQ data using the specified public key.\n");
OTHER
[--daemon] | Daemonize this app at startup
[--export-flow-offload] <cluster> | Enable flows offload and export flows using an ipc queue
[--unprivileged-user|-u] <user> | Use <user> instead of nobody when dropping privileges.
[--pid|-P] <path> | Save the pid into the specified path.
[--version|-V] | Print application version.
[--help|-h] | Help.
[--verbose|-v] | Verbose.
[--show-system-id] | Print the system identifier.
[--check-license] | Checks if the license is present and valid.
[--check-maintenance] | Checks the maintenance status for the specified license
[--syslog|-l] | Dump trace messages to syslog.
[--event-log|-Q] <file> | Save relevant events (i.e. drops) onto the specified file.
Basic example:
n2disk -i eth1 -o /storage -b 1024 -p 512 --disk-limit 50% -I -A /storage
For performance tuning please read the Tuning section.
Dump Set Format¶
n2disk uses the industry standard PCAP file format to dump packets into files, so the resulting output can be easily integrated with existing third party and Open Source analysis tools like ntopng and Wireshark.
PCAP files are indexed and organized in a timeline to enable on-demand retrieval, specifying time interval and BPF criteria.
n2disk by default changes the user to n2disk. This can be changed using the [–unprivileged-user|-u] USER option. As a consequence of this:
- PCAP files are created as 0640 drwxr-x— n2disk n2disk
- Folders are created as 0750 -rw-r—– n2disk n2disk
- In order to read pcap files you need to use n2disk or the n2disk group (npcapextract also supports PAM, please take a look at the Utilities -> npcapextract section)