About Reports and Logs : Viewing controller reports : Capturing and uploading TCP dumps
  
Capturing and uploading TCP dumps
You can capture, download, and upload TCP dumps in the Reports > Controller Dumps: TCP Dumps page. TCP dump files contain summary information for every internet packet received or transmitted on the interface. TCP dump files can help diagnose problems in the system.
The controller provides an easy way to capture and retrieve multiple TCP dumps from the Management Console. You can generate TCP dumps from multiple interfaces at the same time, limit the size of the TCP dump, and schedule a specific date and time to generate a TCP dump. Scheduling and limiting a TCP dump by time or size allows unattended captures.
The top of the TCP Dumps page displays a list of existing TCP dumps and the bottom of the page displays controls to create a new TCP dump. It also includes the TCP dumps that are currently running. The Running Capture Name list includes TCP dumps running at a particular time. It includes TCP dumps started manually and also any dumps that were scheduled previously and are now running.
To capture TCP dumps
1. Choose Reports > Controller Dumps: TCP Dumps to display the TCP Dumps page.
2. Complete the configuration as described in this table.
Control
Description
Add a New TCP Dump
Displays the controls for creating a capture file.
Capture Name
Specify the name of the capture file. Use a unique filename to prevent overwriting an existing capture file. The default filename uses this format:
<hostname>_<interface>_<timestamp>.cap
<hostname> is the hostname of the SteelHead,<interface> is the name of the interface selected for the trace (for example, lan0_0, wan0_0), and <timestamp> is in the yyyy/mm/dd hh:mm:ss format.
If this capture file relates to an open Riverbed Support case, specify the capture filename case_<number> where <number> is your Riverbed Support case number: for example, case_12345.
The .cap file extension is not included with the filename when it appears in the capture queue.
Endpoints
Specify IP addresses and port numbers to capture packets between them:
IPs—Specify IP addresses of endpoints on one side. Separate multiple IP addresses using commas. You can enter IPv6 addresses separated by commas. The default setting is all IP addresses.
Ports—Specify ports on one side. Separate multiple ports using commas. The default setting is all ports.
—and—
IPs—Specify IP addresses of endpoints on the other side. Separate multiple IP addresses using commas. You can enter IPv6 addresses separated by commas. The default setting is all IP addresses.
Ports—Specify ports on the other side. Separate multiple ports using commas. The default setting is all ports.
To capture traffic flowing in only one direction or to enter a custom command, use the CLI tcpdump command. For details, see the Riverbed Command-Line Interface Reference Manual.
Capture Interfaces
Captures packet traces on the selected interfaces. You can select all interfaces or a base, in-path, or RSP interface. The default setting is none. You must specify a capture interface.
If you select several interfaces at a time, the data is automatically placed into separate capture files.
When path selection is enabled, we recommend that you collect packet traces on all LAN and WAN interfaces.
Capture Parameters
These parameters let you capture information about dot1q VLAN traffic. You can match traffic based on VLAN-tagged or untagged packets, or both. You can also filter by port number or host IP address and include or exclude ARP packets. Select one of these parameters for capturing VLAN packets:
• Capture Untagged Traffic Only—Select this option for these captures:
– All untagged VLAN traffic.
– Untagged 7850 traffic and ARP packets. You must also specify "or arp" in the custom flags field on this page.
– Only untagged ARP packets. You must also specify “and arp” in the custom flags field on this page.
• Capture VLAN-Tagged Traffic Only—Select this option for these captures:
– Only VLAN-tagged traffic.
– VLAN-tagged packets with host 10.11.0.6 traffic and ARP packets. You must also specify 10.11.0.6 in the IPs field, and specify "or arp" in the custom flags field on this page.
– VLAN-tagged ARP packets only. You must also specify “and arp” in the custom flags field on this page.
• Capture both VLAN and Untagged Traffic—Select this option for these captures:
– All VLAN traffic.
– Both tagged and untagged 7850 traffic and ARP packets. You must also specify this in the custom flags field on this page:
(port 7850 or arp) or (vlan and (port 7850 or arp))
 
– Both tagged and untagged 7850 traffic only. You must also specify 7850 in one of the port fields on this page. No custom flags are required.
– Both tagged and untagged ARP packets. You must also specify this in the custom flags field on this page:
(arp) or (vlan and arp)
Capture Duration (Seconds)
Specify a positive integer to set how long the capture runs, in seconds. The default value is 30. Specify 0 or continuous to initiate a continuous trace.
For continuous capture, we recommend specifying a maximum capture size and a nonzero rotate file number to limit the size of the TCP dump.
Maximum Capture Size
Specify the maximum capture file size, in MB. The default value is 100. After the file reaches the maximum capture size, TCP dump starts writing capture data into the next file, limited by the Number of Files to Rotate field.
We recommend a maximum capture file size of 1024 MB (1 GB).
Buffer Size
Optionally, specify the maximum amount of data, in KB, allowed to queue while awaiting processing by the capture file. The default value is 154 KB.
Snap Length
Optionally, specify the snap length value for the capture file, which equals the number of bytes captured for each packet. Having a snap length smaller than the maximum packet size on the network enables you to store more packets, but you might not be able to inspect the full packet content. Specify 0 for a full packet capture (recommended for CIFS, MAPI, and SSL captures). The default value is 1518 bytes.
Number of Files to Rotate
Specify how many capture files to keep for each interface before overwriting the oldest file. To stop file rotation, you can specify 0; however, we recommend rotating files, because stopping the rotation can fill the disk partition.
This limits the number of files created to the specified number, and begins overwriting files from the beginning, thus creating a rotating buffer.
The default value is five files per interface. The maximum value is a 32-bit integer.
Custom Flags
Specify custom flags as additional statements within the filter expression. Custom flags are added to the end of the expression created from the Endpoints fields and the Capture Parameters radio buttons (pertaining to VLANs).
If you require an “and” statement between the expression created from other fields and the expression that you’re entering in the custom flags field, you must include the “and” statement at the start of the custom flags field.
Don’t use host, src, or dst statements in the custom flags field. Although it is possible in trivial cases to get these statements to start without a syntax error, they don’t capture GRE-encapsulated packets that some modes of SteelHead communications use, such as WCCP deployments or Interceptor connection-setup traffic. We recommend using bidirectional filters by specifying endpoints.
For complete control of your filter expression, use the CLI tcpdump command. For details, see the Riverbed Command-Line Interface Reference Manual.
For examples, see Custom flag use examples.
Schedule Dump
Schedules the capture to run at a later date and time.
Start Date
Specify a date to initiate the capture, in this format: yyyy/mm/dd
Start Time
Specify a time to initiate the capture, in this format: hh:mm:ss
Add
Adds the capture request to the capture queue.
If a problem occurs with an immediate or scheduled TCP dump, a warning message appears. Check the system log for details about the error and check the TCP dump for syntax errors.
Custom flag use examples
The examples in this table focus on the custom flag entry but rely on other fields to create a complete filter.
Filter purpose
Custom flag
To capture all traffic on VLAN 10 between two specified endpoints: 1.1.1.1 and 2.2.2.2
and vlan 10
To capture any packet with a SYN or an ACK
tcp[tcpflags] & (tcp-syn|tcp-ack) != 0
To capture any packet with a SYN
tcp[tcpflags] & (tcp-syn) != 0
—or—
tcp[13] & 2 == 2
To capture any SYN to or from host 1.1.1.1
and (tcp[tcpflags] & (tcp-syn) != 0)
—or—
and (tcp[13] & 2 == 2)
IPv6 custom flag use examples
The examples in this table focus on the custom flag entry, but rely on other fields to create a complete filter.
To build expressions for TCP dumps, IPv6 filtering does not currently support the TCP, UDP, and other upper-layer protocol types that IPv4 supports. Also, these IPv6 examples are based on the assumption that only a single IPv6 header is present.
Filter purpose
Custom flag
To capture all FIN packets to or from host 2001::2002
and (ip6[53] & 1!=0)
To capture all IPv6 SYN packets
ip6 or proto ipv6 and (ip6[53] & 2 == 2)
To upload a TCP dump file to Riverbed support
1. Choose Reports > Controller Dumps: TCP Dumps to display the TCP Dumps page.
2. Select the filename.
3. Optionally, specify a case number that corresponds to the system dump. Support recommends using a case number: for example, 194170.
You can also enter the CLI command file debug dump upload URL to specify a URL instead of a case number. When you specify a URL, the dump file goes directly to the URL.
If the URL points to a directory on the upload server, it must have a trailing backslash (/).
For example:
ftp://ftp.riverbed.com/incoming/
(not ftp://ftp.riverbed.com/incoming)
The filename as it exists on the appliance will then match the filename on the upload server.
For details, see the Riverbed Command-Line Interface Reference Manual.
4. Click Upload.
Because uploading a system dump can take a while, the status appears during the upload. When the system dump finishes uploading, the date, time, and a status of either uploaded (appears in green) or failed (appears in red). An explanation appears for uploads that fail.
Stopping a TCP dump after an event occurs
Capture files offer visibility into intermittent network issues, but the amount of traffic they capture can be overwhelming. Also, because rotating logs is common, after a capture logs an event, the SteelHead appliance log rotation can overwrite debugging information specific to the event.
Client Accelerator provides trigger that can stop a continuous capture after a specific log event occurs. The result is a smaller file to help pinpoint what makes the event happen.
The stop trigger continuously scans the system logs for a search pattern. When it finds a match, it stops all running captures.
To stop a capture after a specific log event
1. Choose Reports > Controller Dumps: TCP Dumps to display the TCP Dumps page.
2. Schedule a capture.
3. In the Pattern text box, enter a Perl regular expression (regex) to find in a log. RiOS compares the Perl regex against each new line in the system logs and the trigger stops if it finds a match.
The simplest regex is a word or a string of characters. For example, if you set the pattern to “Limit,” the trigger matches the line “Connection Limit Reached.”
Notes:
– Perl regular expressions are case sensitive.
– Perl treats the space character like any other character in a regex.
– Perl reserves some characters, called metacharacters, for use in regex notation. The metacharacters are:
{ } [ ] ( ) ^ $ . | * + ? \
– You can match a metacharacter by putting a backslash before it. For example, to search for a backslash in the logs, you must enter two backslashes (\\) as the pattern.
– The pattern follows Perl regular expression syntax. For details, go to:
http://perldoc.perl.org/perlre.html
– You can’t change the pattern while a scan is running. You must stop the scan before changing a pattern.
– You don’t need to wrap the pattern with the metacharacters to match the beginning or end of a line (^ $) or with the wildcard character (*).
4. Specify the amount of time to pause before stopping all running captures when the controller finds a match. This setting gives the system some time to log more data without abruptly cutting off the capture. The default is 30 seconds. Specify 0 for no delay; the capture stops immediately.
After a trigger has fired, the capture can stop by itself before the delay expires: for example, the capture duration can expire.
5. Click Start Scan.
When the scan stops, the controller sends an email to all email addresses on the Administration > System Settings: Email page appearing under Report Events via Email. The email notifies users that the trigger has fired.
The page indicates “Last Triggered: Never” if a TCP Dump stop trigger has never triggered on the controller. After the delay duration of the stop trigger, the controller displays the last triggered time.
Before changing the Perl regular expression or amount of delay, you must first stop the process.
To stop a running scan
• Click Stop Scan to halt the background process that monitors the system logs. The controller dims this button when the stop trigger is idling.
Stop trigger limitations
These limitations apply to the trigger:
• You can’t create a trigger to stop a specific capture; the trigger affects all running captures.
• If the search pattern contains a typo, the trigger might never find a match.
• Only one instance of a trigger can run at one time.
To view controller TCP dump files
1. Choose Reports > Controller Dumps: TCP Dumps to display the TCP Dumps page.
2. Under Download Link, select the TCP dump name to open the file.
To print the TCP dump, select the TCP dump filename under Download Link. When the file opens, choose File > Print in your web browser to open the Print dialog box.
To remove an entry, select the check box next to the name in the TCP dump list and click Remove Selected.
To stop a running TCP dump
1. Choose Reports > Controller Dumps: TCP Dumps to display the TCP Dumps page.
2. Select the TCP dump filename in the Running Capture Name list.
3. Click Stop Selected Captures.
In continuous mode, after you complete the capture, perform these steps to upload a TCP dump to Support. (For timed TCP dumps, start with Step 2.)