The naming conventions for PCAP files are discussed in the following sections
Note |
Only monitor-subscriber-file-name and rotation options are used in naming PCAP files.
|
Slowpath File Name Convention
The slow path file names appear in the following format:
curr_slowpath_{SMGR Mon Sub Session Id}_{monsub_file_name_option_val}_{Timestamp}_{RotationCount}.pcap
or
slowpath_{SMGR Mon Sub Session Id}_{monsub_file_name_option_val}_{Timestamp}_{RotationCount}.pcap
File with ‘curr_’ prefix is the file, that is currently being written to, that is still not closed. When files are to be rotated
(depending on the file rotation parameters), file without the ‘curr_’ prefix are copied to hard disk.
The SMGR MonSub Session Id – This is the session Id for MonSub session created on Uplane SMGR instance ID, which created this
PCAP. This Id is local to SMGR instance, so there could be two SLOWPATH pcap captured with same ID.
When files are to be copied to hard disk, The monsub_file_name_option_val is replaced by:
-
IMSI value if monitor-subscriber-file-name is set to "imsi".
-
Call ID value if monitor-subscriber-file-name is set to "call-id"
-
Username value if monitor-subscriber-file-name is set to ‘username’
Timestamp is in the following format "MMDDYYYYHHMMSS", where:
-
MM - Month, DD - Date and YYYY - Year.
-
HH -Hour, MM - Minutes and SS - Seconds.
RotationCount is a 9-digit value that is incremented every time an old file is rotated, and a new file is generated.
00000000 for the first file, 00000001 for the second file and so on.
Rotation of slowpath files is determined by following option in hexdump-module file configuration:
rotation { num-records number | time seconds| volume bytes }
-
num-records: num-records specifies the number of packets after which a new file is generated and ‘RotationCount’ in the filename is incremented.
The range of number is between 100 to 10240, and the default value is 1024.
-
time: time specifies the time to wait in seconds before a new file is generated and ‘RotationCount’ in the filename is incremented.
seconds must be an integer from 30 through 86400. The default value is 3600.
-
volume: volume specifies the number of bytes after which a new file is generated and ‘RotationCount’ in the filename is incremented.
bytes must be an integer from 51200 through 62914560. The default value is 102400.
Note |
The tarriff-time parameter under rotation is ignored as it is not suitable for PCAP file capture.
|
The following are examples of the file naming conventions for slowpath PCAP files.
-
For the ‘imsi’ option where IMSI is ‘112233445566778’, slowpath files are named as:
slowpath_S0_112233445566778_07152019050907_000000000.pcap
-
For ‘call_id’ option where Call Id is ‘01317b22’, slowpath files are named as:
slowpath_S0_01317b22_07152019050907_000000000.pcap
Note |
The parameter tarrif-time is not applicable for PCAP file capture.
|
Fastpath File Name Convention
The fastpath file names appear in the following format:
vpp_{S}_{B}_{encap}_{monsub_file_name_option}_{Timestamp}_{FileCount}.pcap
-
S is replaced by either ‘S1’, ‘S2’,'S3’, or 'S4’.
-
B is replaced by either ‘B0’,‘B1’,'B2', or 'B3' depending on the bundle generated by Panopticon.
-
monsub_file_name_option is replaced by:
-
IMSI value if monitor-subscriber-file-name is set to "imsi".
-
Call ID value if monitor-subscriber-file-name is set to "call-id"
-
Username value if monitor-subscriber-file-name is set to ‘username’
Timestamp is in the following format "MMDDYYYYHHMMSS", where:
-
MM - Month, DD - Date and YYYY - Year.
-
HH -Hour, MM - Minutes and SS - Seconds.
RotationCount is a 9-digit value that is incremented every time an old file is rotated, and a new file is generated.
00000000 for the first file, 00000001 for the second file and so on.
Fast path "FileCount" is not the same as the slowpath "RotationCount" parameters and hence ‘hexdump-module file rotation’
parameters are ignored while naming fastpath files.
In Phases 1 of the feature, fastpath generated file names are like ‘vpp_S1_B0_ip.pcap’ or ‘vpp_S1_B1_ip.pcap’, they are renamed
to following when being copied over to non-volatile storage:
-
vpp_S1_B0_ip_01317b22_07152019050907_000000000.pcap
-
vpp_S1_B1_ip_01317b22_07152019050908_000000001.pcap
-
vpp_S1_B0_ip_01317b22_07152019050908_000000002.pcap
In MonSub phase 3, a PCAP “bundle” is replaced with a single PCAP file that uses Ethernet encapsulation.
In Phase 3, each fastpath session file is captured in the Ethernet PCAP file that is ‘vpp_S0_B0_eth.pcap’ and they are renamed
to following when being copied to a non-volatile storage:
vpp_S0_B0_eth_01317b22_07152019050907_000000000.pcap
For ‘callid’ option where Call Id is ‘12345678ef’:
-
slowpath_S0_12345678ef _07152019050907_000000000.pcap
-
vpp_S1_B0_eth_12345678ef _07152019050907_000000000.pcap
For ‘username’ option where username is ‘9890098900’:
-
slowpath_S0_07152019050907_000000000_9890098900.pcap
-
vpp_S1_B0_eth_07152019050907_000000000_9890098900.pcap