Viavi Apex Enterprise G3-APEX-ENT-32T, User Manual

Page: 215 / 380

Capturing packets with the GigaStor
Chapter 6: Packet Captures 215
●
Forensics may be hindered without full payload data
●
Data stream reconstruction may not work
♦
Most resource intensive capturing
●
Increases CPU utilization
To configure the GigaStor probe to trim all packet data beyond the first 64-bytes,
choose and then Settings > Capture Options . In that tab, enable Capture
Partial Packets (Bytes) .
2. Click the Settings button.
3. Click the General Options tab. See Setting the GigaStor general options
(page 189) for a description of each field.
4. Enable the Capture partial packets option and choose how many bytes to
include in the capture. The rest of the packet beyond what you define is
excluded and is not saved to disk.
It is possible to decrease or increase the default 64-byte partial packet
capture size. Click the Change Size button to set a custom value. From then
on, each packets’ bytes following the target value are discarded from capture.
Password protecting the ability to change partial packet
capture size
Password protecting this option helps ensure your partial captures remain partial,
saving you disk space and enhancing data subject privacy because payload is not
recorded in full.
In Observer, to password protect the ability to change partial packet capture
size:
♦
Click the Security tab, and enable Require a Password to Change
Partial Packet Capture Size .
Differences between statistics and packets
Observer uses packets and statistics about your traffic to provide you with
information about your network. This topic describes why each is useful and why
there may appear to be discrepancies between a statistical view and the actual
packets.
At times you may notice what appears to be a discrepancy between what you
see in the GigaStor Control Panel and what you see when you are analyzing
packets in a selected time frame. The difference stems from the fact that the
GigaStor Control Panel displays statistics based on a sample of the packets seen,
but when you are analyzing a specific time frame you are viewing all of the
actual packets.
The GigaStor uses samples for a couple of reasons. First, it is more efficient to
sample large sets of data rather than to process each data point individually.
Network traffic is ideally suited for statistical sampling. Second, statistics serve
a different role than actual packets. Statistics are intended to give you an
indication of what is happening with your network. If the statistics indicate you
may have an issue, then you can use the actual packets saved in your GigaStor to
further analyze the traffic.