CRU 31030-1577-0000 User Manual Download Page 8

8

Protecting Your Digital Assets

TM

Ditto Network Tap Module User Manual

f.  Use the “Select Filter...” drop-down box and select 

New Filter...

 to create a new fi lter or select an 

existing fi lter to overwrite it.

g.  Use the “Select File...” drop-down box and select 

New File...

 to create a new XML fi le, or select an 

existing fi le to add your network capture fi lter to the fi le. 

h.  Type the desired fi lename into the “File Name” text box. 

i.  Type the desired name of the fi lter into the “Filter Name” text box. 

j.  Click the 

Save button

 to save the fi lter.

3.4.2 Manual Filter Creation

To manually create a network capture fi lter on an SD Card, you must manually create a 

DittoNetCap-

Filter 

directory on your SDCard fi rst. Then you can add one or more network capture fi lter XML fi les to 

that directory. 

Create an XML fi le using the following structure and place it within the DittoNetCapFilter directory on 
your SDCard:

<?xml version=”1.0” encoding=”UTF-8”?>
<!-- All attributes must be in single quotes if they contain double quotes. 
-->
<dittoNetCapFilter
  xmlns:xsi=”http://www.w3.org/2001/XMLSchema-instance”
  xsi:noNamespaceSchemaLocation=”netCapFilter.xsd”
>

  <fi lter title=”All”>insert port numbers here, separated by the word‘or’</
fi lter>

</dittoNetCapFilter>

The name of the network capture fi lter XML fi le can be any legal fi le name with an XML fi le extension. 
Each XML fi le may contain one or more <fi lter title=”...”> blocks. The fi lter block’s title will appear at 
the bottom of the “Network Capture Filter” selection list prepended with “SDCard/” followed by the 
subdirectory’s name, if any. 

You cannot remove existing selections from the Network Capture Filter list. 

Figure 3. 

The “Action” screen, showing where to type in the 

ports that you wish to capture with the “Network Capture” 

action.

Figure 4. 

The “Save Network Capture Filter” 

dialog box lets you save custom network 

capture fi lters.

NOTE

Summary of Contents for 31030-1577-0000

Page 1: ...c FieldStations Captures Internet and VOIP traffic with virtually no packet loss Captures sustained 10 100 Mbps network traffic and short burst gigabit network traffic Filter and capture network traffic to a tcpdump Wireshark compatible PCAP file Optional live capture stream rpcap interface for Wireshark Fail safe design continues passing through network traffic if power is lost Packet loss is a f...

Page 2: ... Contents 2 1 2 Identifying Parts 2 1 3 How to Use the Network Tap Module 3 2 Setup 3 3 Network Tap Functionality 3 3 1 Home Screen 3 3 1 1 PCAP Network Capture 3 3 1 2 Live Network Capture 4 3 1 3 Simultaneous PCAP and Live Network Capture 5 3 2 Configure Screen 5 3 2 1 System 5 3 2 2 Network 6 3 3 Network Capture 6 3 3 1 Network Capture Settings 6 3 3 2 Live Capture Settings 7 3 3 3 Advanced Set...

Page 3: ...Tap Module You may access its settings via the Browser Interface see your Ditto product s user manual or via the Front Panel see Section 3 5 3 NETWORK TAP FUNCTIONALITY The Network Tap Module adds several new actions and functions to the Ditto and Ditto DX browser interface and Front Panel They are listed below 3 1 HOME SCREEN The Network Tap Module adds a Network Capture action to Action panel on...

Page 4: ...nd if hashing is enabled a TXT file that contains each of the generated PCAP files MD5 or SHA 1 hash value see Section 5 1 2 to enable hashing 3 1 2 Live Network Capture a Using the Browser Interface select Network Capture from the Action to Perform drop down box b Select the network capture filter from the Network Capture Filter drop down box or type in the ports you wish to capture in the text b...

Page 5: ...Stop button You can view the log of the PCAP network capture action by scrolling down to the System Log panel on the Home screen Find and click on the latest link which will be denoted by a filename with a date timestamp format S_yyyymmddhhmmss Alternatively you can click on the Logs button from the top menu bar You can view the data retrieved from the PCAP network capture action by examining the ...

Page 6: ...eated on the des tination disk When the number is reached the Network Tap Module will begin overwriting the oldest file on the disk for each new file that is created Set this to 0 to fill the disk until it reaches capacity Image File Segment Size Allows you to specify the size in bytes that each image file should be The minimum size is 1M megabyte The maximum size is limited by the target file sys...

Page 7: ... LANs will use the standard MTU of 1500 The commonly accepted range for a valid MTU is 68 to 65 535 as defined in RFC 791 Click the Information icon for more information Link Speed Allows you to set the Ethernet connection speed throughput In most cases Auto Negotiate will work If you experience problems staying connected you may need to change the speed to match what your network s capabilities a...

Page 8: ...ing structure and place it within the DittoNetCapFilter directory on your SDCard xml version 1 0 encoding UTF 8 All attributes must be in single quotes if they contain double quotes dittoNetCapFilter xmlns xsi http www w3 org 2001 XMLSchema instance xsi noNamespaceSchemaLocation netCapFilter xsd filter title All insert port numbers here separated by the word or filter dittoNetCapFilter The name of t...

Page 9: ...None MD5 SHA 1 SHA 256 MD5 SHA 1 MD5 SW SHA 1 MD5 SHA 1 SW MD5 SHA256 MD5 SW SHA 256 MD5 SHA 256 SW MD5 SW SHA 1 SW MD5 SW SHA 1 SW SHA 1 SW MD5 SHA 1 SW SHA 256 SHA 256 SW MD5 SHA 256 SW or SHA 512 SW NetCap Settings This new section allows you to modify the settings that govern network capture actions NetCap Filter Sets the default network capture filter for the Network Capture action The availa...

Page 10: ...you may need to change the speed to match what your network s capabilities are 4 TECHNICAL SPECIFICATIONS Product Name Ditto Network Tap Module Ditto Family Compatibility Ditto Forensic FieldStation Ditto DX Forensic FieldStation Data Interface Types Speeds 1000BASE T EtherNet up to 1 Gbps USB 2 0 up to 480 Mbps Supported Drive Types External USB HDDs SSDs and media card readers Data Connectors Tw...

Page 11: ...or addition to this warranty In no event will CRU or its suppliers be liable for any costs of procurement of substitute products or services lost profits loss of information or data computer malfunction or any other special indirect consequential or incidental damages arising in any way out of the sale of use of or inability to use any CRU product or service even if CRU has been advised of the pos...

Reviews: