Traffic CaptureΒΆ

These commands enable displaying, capturing, managing and exporting network traffic flowing through a given network interface.

Display the network traffic flowing through a given network interface.

vsr> cmd traffic-capture eth0 filter udp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
17:05:04.109799 de:ad:de:01:02:03 > 52:56:00:00:00:02, ethertype IPv6 (0x86dd), length 110: fec0::dcad:deff:fe01:203.123 > 2001:67c:1560:8003::c7.123: NTPv4, Client, length 48
17:05:11.109828 de:ad:de:01:02:03 > 52:55:0a:00:02:02, ethertype IPv4 (0x0800), length 90: 10.0.2.15.123 > 91.121.7.182.123: NTPv4, Client, length 48
17:05:13.109796 de:ad:de:01:02:03 > 52:56:00:00:00:02, ethertype IPv6 (0x86dd), length 110: fec0::dcad:deff:fe01:203.123 > 2001:bc8:2717:100::1.123: NTPv4, Client, length 48
^C
3 packets captured
3 packets received by filter
0 packets dropped by kernel
vsr>

The new argument enables capturing traffic in a given network interface:

vsr> cmd traffic-capture new name traffic-eth0 filter udp eth0
tcpdump: listening on mgmt0, link-type EN10MB (Ethernet), capture size 262144 bytes
^C3 packets captured
3 packets received by filter
0 packets dropped by kernel
vsr>

Both commands can be interrupted by hitting ctrl-c.

See also

It is also possible to list or flush all traffic captured in the machine or remove a specific one respectively with the list, flush and delete commands.

vsr> cmd traffic-capture list
traffic-eth0
traffic-eth1
vsr> cmd traffic-capture delete traffic-eth0
OK.
vsr>

Then a specific capture can be read or exported with the read and export commands:

See also

vsr> cmd traffic-capture read traffic-eth0
reading from file /var/lib/yams/traffic-captures/traffic-eth0.pcap, link-type EN10MB (Ethernet)
17:05:04.109799 de:ad:de:01:02:03 > 52:56:00:00:00:02, ethertype IPv6 (0x86dd), length 110: fec0::dcad:deff:fe01:203.123 > 2001:67c:1560:8003::c7.123: NTPv4, Client, length 48
17:05:11.109828 de:ad:de:01:02:03 > 52:55:0a:00:02:02, ethertype IPv4 (0x0800), length 90: 10.0.2.15.123 > 91.121.7.182.123: NTPv4, Client, length 48
17:05:13.109796 de:ad:de:01:02:03 > 52:56:00:00:00:02, ethertype IPv6 (0x86dd), length 110: fec0::dcad:deff:fe01:203.123 > 2001:bc8:2717:100::1.123: NTPv4, Client, length 48
vsr> cmd traffic-capture export traffic-eth0 url scp://user:passwd@host/tmp/
OK.
vsr>

See also