Configure packet capture for the network analyzer

To use the network analyzer, you must create one or more packet capture configuration.

Required configuration items

Additional configuration items

To configure a packet capture configuration:


  1. Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
  2. Access the device configuration:

    1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
    2. Click the Device ID.
    3. Click Settings.
    4. Click to expand Config.

    1. On the menu, click System. Under Configuration, click Device Configuration.

      The Configuration window is displayed.

  3. Click Network > Analyzer.
  4. For Add Capture settings, type a name for the capture filter and click .

    The new capture filter configuration is displayed.

  5. (Optional) Add a filter type:
    1. Click to expand Filter.

      You can select from preconfigured filters to determine which types of packets to capture or ignore, or you can create your own Berkeley packet filter expression.

    2. To create a filter that either captures or ignores packets from a particular IP address or network:
      1. Click to expand Filter IP addresses or networks.
      2. Click to add an IP address/network.

      3. For IP address or network, type the IPv4 or IPv6 address (and optional netmask).
      4. For Source or destination IP address, select whether the filter should apply to packets when the IP address/network is the source, the destination, or both.
      5. Click Ignore this IP address or network if the filter should ignore packets from this IP address/network. By default, is option is disabled, which means that the filter will capture packets from this IP address/network.
      6. Click to add additional IP address/network filters.
    3. To create a filter that either captures or ignores packets that use a particular IP protocol:
      1. Click to expand Filter IP protocols.
      2. Click to add an IP protocol.
      3. For IP protocol to capture or ignore, select the protocol. If Other protocol is selected, type the number of the protocol.
      4. Click Ignore this protocol if the filter should ignore packets that use this protocol. By default, is option is disabled, which means that the filter will capture packets that use this protocol.
      5. Click to add additional IP protocols filters.
    4. To create a filter that either captures or ignores packets from a particular port:
      1. Click to expand Filter TCP/UDP port.
      2. Click to add a TCP /UDP port.
      3. For IP TCP/UDP port to capture or ignore, type the number of the port to be captured or ingored.
      4. For TCP or UDP port, select the type of transport protocol.
      5. For Source or destination TCP/UDP port, select whether the filter should apply to packets when the port is the source, the destination, or both.
      6. Click Ignore this TCP/UDP port if the filter should ignore packets that use this port. By default, is option is disabled, which means that the filter will capture packets that use this port.
      7. Click to add additional port filters.
    5. To create a filter that either captures or ignores packets from one or more specified MAC addresses:
      1. Click to expand Filter Ethernet MAC addresses.
      2. Click to add a MAC address.
      3. For Ethernet MAC address, type the MAC address to be captured or ingored.
      4. For Source or destination Ethernet MAC address, select whether the filter should apply to packets when the Ethernet MAC address is the source, the destination, or both.
      5. Click Ignore this MAC address if the filter should ignore packets that use this port. By default, is option is disabled, which means that the filter will capture packets that use this port.
      6. Click to add additional MAC address filters.
    6. To create a filter that either captures or ignores packets from one or more VLANs:
      1. Click to expand Filter VLANs.
      2. Click to add a VLAN.
      3. For The VLAN to capture or ignore, type the number of the VLAN.
      4. Click Ignore this VLAN if the filter should ignore packets that use this port. By default, is option is disabled, which means that the filter will capture packets that use this port.
      5. Click to add additional VLAN filters.
    7. For Berkeley packet filter expression, type a filter using Berkeley Packet Filter (BPF) syntax. See Example filters for capturing data traffic for examples of filters using BPF syntax.
  6. Add one or more interface to the capture filter:
    1. Click to expand Device.
    2. Click to add an interface to the capture setting instance.

    3. For Device, select an interface.
    4. Repeat to add additional interfaces to the capture filter.
  7. (Optional) For Berkeley packet filter expression, type a filter using Berkeley Packet Filter (BPF) syntax. See Example filters for capturing data traffic for examples of filters using BPF syntax.
    1. For Run mode, select the mode that will be used to run the capture filter. Available options are:
      • On boot: The capture filter will run once each time the device boots.
      • Interval: The capture filter will start running at the specified interval, within 30 seconds after the configuration change is saved.
        • If Interval is selected, in Interval, type the interval.

          Allowed values are any number of weeks, days, hours, minutes, or seconds, and take the format number{w|d|h|m|s}.

          For example, to set Interval to ten minutes, enter 10m or 600s.

      • Set time: Runs the capture filter at a specified time of the day.
        • If Set Time is selected, specify the time that the capture filter should run in Run time, using the format HH:MM.
      • During system maintenance: The capture filter will run during the system maintenance time window.
    2. Enable the capture filter schedule.
    3. For Duration, type the amount of time that the scheduled analyzer session will run.

      Allowed values are any number of weeks, days, hours, minutes, or seconds, and take the format number{w|d|h|m|s}.

      For example, to set Duration to ten minutes, enter 10m or 600s.

    4. For Save interval, type the frequency with which captured events will be saved.

      Allowed values are any number of weeks, days, hours, minutes, or seconds, and take the format number{w|d|h|m|s}.

      For example, to set Save interval to ten minutes, enter 10m or 600s.

  9. Click Apply to save the configuration and apply the change.
  1. Select the device in Remote Manager and click Actions > Open Console, or log into the EX12 local command line as a user with full Admin access rights.

    Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.

  2. At the command line, type config to enter configuration mode:

    > config
(config)>

  3. Add a new capture filter:
    (config)> add network analyzer name
(config network analyzer name)>
  4. Add an interface to the capture filter:
    (config network analyzer name)> add device end device
(config network analyzer name)>

    To determine available devices and proper syntax, use the space bar autocomplete feature:

    (config network analyzer name)> add device end <space>
/network/device/eth1                /network/device/eth2
/network/device/loopback            /network/interface/aview
/network/interface/setupip        /network/interface/defaultlinklocal
/network/interface/eth1             /network/interface/eth2
/network/interface/loopback         /network/interface/modem
(config network analyzer name)> add interface end /network/

    Repeat to add additional interfaces.

      1. Add a new IP address/network filter:
        (config network analyzer name)> add filter address end
(config network analyzer name filter address 0)>
      2. Set the IPv4 or IPv6 address (and optional netmask):
        (config network analyzer name filter address 0)> address ip_address[/netmask]
(config network analyzer name filter address 0)>
      3. Set whether the filter should apply to packets when the IP address/network is the source, the destination, or both:
        (config network analyzer name filter address 0)> match value
(config network analyzer name filter address 0)>

        where value is one of:

        • source: The filter will apply to packets when the IP address/network is the source.
        • destination: The filter will apply to packets when the IP address/network is the destination.
        • either: The filter will apply to packets when the IP address/network is either the source or the destination.

      4. (Optional) Set the filter should ignore packets from this IP address/network:

        (config network analyzer name filter address 0)> ignore true
(config network analyzer name filter address 0)>

        By default, is option is set to false, which means that the filter will capture packets from this IP address/network.

      5. Repeat these steps to add additional IP address filters.
      1. Add a new IP protocol filter:
        (config network analyzer name)> add filter protocol end
(config network analyzer name filter protocol 0)>
      2. Use the ? to determine available protocols and the appropriate format:
        (config network analyzer name filter protocol 0)> protocol ?

IP protocol to capture or ignore: IP protocol to capture or ignore.
Format:
  ah
  esp
  gre
  icmp
  icmpv6
  igmp
  ospf
  other
  tcp
  udp
  vrrp
Current value:

(config network analyzer name filter protocol 0)>
      3. Set the protocol:
        (config network analyzer name filter protocol 0)> protocol value
(config network analyzer name filter protocol 0)>
      4. If other is set for the protocol, set the number of the protocol:
        (config network analyzer name filter protocol 0)> protocol_other value
(config network analyzer name filter protocol 0)>

        where value is an integer between 1 and 255 and represents the the number of the protocol.

      5. (Optional) Set the filter should ignore packets from this protocol:

        (config network analyzer name filter protocol 0)> ignore true
(config network analyzer name filter protocol 0)>

        By default, is option is set to false, which means that the filter will capture packets from this protocol.

      6. Repeat these steps to add additional protocol filters.
      1. Add a new port filter:
        (config network analyzer name)> add filter port end
(config network analyzer name filter port 0)>
      2. Set the transport protocol that should be filtered for the port:
        (config network analyzer name filter port 0)> protocol value
(config network analyzer name filter port 0)>

        where value is one of tcp, udp, or either. The default is either.

      3. Set whether the filter should apply to packets when the port is the source, the destination, or both:
        (config network analyzer name filter port 0)> match value
(config network analyzer name filter port 0)>

        where value is one of:

        • source: The filter will apply to packets when the port is the source.
        • destination: The filter will apply to packets when the port is the destination.
        • either: The filter will apply to packets when the port is either the source or the destination.

      4. (Optional) Set the filter should ignore packets from this port:

        (config network analyzer name filter port 0)> ignore true
(config network analyzer name filter port 0)>

        By default, is option is set to false, which means that the filter will capture packets from this port.

      5. Repeat these steps to add additional port filters.
      1. Add a new MAC address filter:
        (config network analyzer name)> add filter mac_address end
(config network analyzer name filter mac_address 0)>
      2. Set the MAC address that should be be captured or ignored:
        (config network analyzer name filter mac_address 0)> address value
(config network analyzer name filter mac_address 0)>

        where value is the MAC address to be filtered, using colon-hexadecimal notation with lower case, for example, 00:aa:11:bb:22:cc.

      3. Set whether the filter should apply to packets when the MAC address is the source, the destination, or both:
        (config network analyzer name filter mac_address 0)> match value
(config network analyzer name filter mac_address 0)>

        where value is one of:

        • source: The filter will apply to packets when the MAC address is the source.
        • destination: The filter will apply to packets when the MAC address is the destination.
        • either: The filter will apply to packets when the MAC address is either the source or the destination.

      4. (Optional) Set the filter should ignore packets from this port:

        (config network analyzer name filter mac_address 0)> ignore true
(config network analyzer name filter mac_address 0)>

        By default, is option is set to false, which means that the filter will capture packets from this MAC address.

      5. Repeat these steps to add additional MAC addresses.
      1. Add a new VLAN filter:
        (config network analyzer name)> add filter vlan end
(config network analyzer name filter vlan 0)>
      2. Set the VLAN that should be be captured or ignored:
        (config network analyzer name filter vlan 0)> vlan value
(config network analyzer name filter vlan 0)>

        where value is number o the VLAN.

      3. (Optional) Set the filter should ignore packets from this VLAN:

        (config network analyzer name filter vlan 0)> ignore true
(config network analyzer name filter vlan  0)>

        By default, is option is set to false, which means that the filter will capture packets from this MAC address.

      4. Repeat these steps to add additional VLANs.
    6. (config network analyzer name)> filter custom value
(config network analyzer name)>

      where value is a filter using Berkeley Packet Filter (BPF) syntax. Values that contain spaces must be enclosed in double quotes (").

      See Example filters for capturing data traffic for examples of filters using BPF syntax.

    1. Enable scheduling for this capture filter:
      (config network analyzer name)> schedule enable true
(config network analyzer name)>
    2. Set the mode that will be used to run the capture filter:
      (config network analyzer name)> when mode
(config network analyzer name)>

      where mode is one of the following:

      • boot: The script will run once each time the device boots.
      • interval: The script will start running at the specified interval, within 30 seconds after the configuration change is saved. If interval is selected, set the interval:
        (config add network analyzer name)> on_interval value
(config add network analyzer name)>

        where value is any number of weeks, days, hours, minutes, or seconds, and takes the format number{w|d|h|m|s}.

        For example, to set on_interval to ten minutes, enter either 10m or 600s:

        (config network analyzer name)> on_interval  600s
(config network analyzer name)>

      • set_time: Runs the script at a specified time of the day. If set_time is set, set the time that the script should run, using the format HH:MM:
        (config network analyzer name)> run_time HH:MM
(config network analyzer name)>
      • maintenance_time: The script will run during the system maintenance time window.

    3. Set the amount of time that the scheduled analyzer session will run:
      (config network analyzer name)> duration value
(config network analyzer name)>

      where value is any number of weeks, days, hours, minutes, or seconds, and takes the format number{w|d|h|m|s}.

      For example, to set duration to ten minutes, enter either 10m or 600s:

      (config network analyzer name)> save_interval 600s
(config network analyzer name)>
    4. Set the frequency with which captured events will be saved:
      (config network analyzer name)> save_interval value
(config network analyzer name)>

      where value is any number of weeks, days, hours, minutes, or seconds, and takes the format number{w|d|h|m|s}.

      For example, to set save_interval to ten minutes, enter either 10m or 600s:

      (config network analyzer name)> save_interval 600s
(config network analyzer name)>
  7. Save the configuration and apply the change.
    (config)> save
Configuration saved.
>
  8. Type exit to exit the Admin CLI.

    Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.