Cisco SCE 8000 10GBE, Руководство по настройке программного обеспечения

Страница: 100 / 478

4-18
Cisco SCE 8000 10GBE Software Configuration Guide
OL-30621-02
Chapter 4 Utilities
Flow Capture
The Flow Capture Process
There are three main steps in the overall flow capture process:
1.
Configure the traffic rules to define the traffic to be captured. ( “Configuring a Flow Capture Traffic
Rule” section on page 4-18 )
2. Configure the flow capture settings. (Optional) ( “Configuring the Flow Capture Settings” section on
page 4-18 )
3.
Perform the actual flow capture. ( “Performing the Flow Capture” section on page 4-20 )
Configuring a Flow Capture Traffic Rule
The flow capture traffic rules define the traffic to be captured. You can configure a flow capture traffic
rule by specifying the
flow-capture action for the relevant flows.
For example, in order to capture all the traffic sent to or coming from subscribers whose IP addresses
are in the range.2.3.0-1.2.3.255, define a traffic rule as follows:
SCE(config if)# traffic-rule name flowcapturerule IP-addresses subscriber-side 1.2.3.0/24
network-side all protocol all direction both traffic-counter none action flow-capture
Multiple rules can be configured, but note that all configured flow capture rules are in effect during the
flow capture process. It is not possible to apply only a subset of the configured rules.
For more information regarding configuring traffic rules, see “Configuring Traffic Rules and Counters”
section on page 7-26 .
Configuring the Flow Capture Settings
The flow capture settings control aspects of the flow capture process, as opposed to defining the flow to
be captured. These settings limit the scope of the process to maximize the recorded information while
minimizing the effect on traffic.
• Maximum duration of the capture: By limiting the duration of the capture, you can limit the effect
of the capture on live traffic.
You can stop the capture at any time before the maximum duration has been reached.
• Maximum length of the L4 payload of each captured packet: If you want to capture mainly the L2-L4
headers, you need only a small portion of the payload of each packet. Setting a limit on the length
of the payload makes the capture more efficient, as it allows more packets to be captured within a
given time frame and for a given throughput.
Guidelines and Information:
– If maximum L4 payload length is not configured, all bytes of each captured packet are recorded.
–
If maximum L4 payload length is configured, each captured packet will contain the entire L2/
L3/L4 headers and no more than the configured maximum bytes of L4 payload.
– Only one maximum L4 payload length value can be configured. This value applies to all
recorded packets.