PCAP File Name Convention

Following section discusses the naming conventions for PCAP files:

Note

Only monitor-subscriber-file-name and rotation options are used in naming PCAP files.

Slowpath File Name Convention

The slowpath file names appear in the following format:

curr_slowpath_{SMGR Mon Sub Session Id}_{monsub_file_name_option_val}_{Timestamp}_{RotationCount}.pcap

or

slowpath_{SMGR Mon Sub Session Id}_{monsub_file_name_option_val}_{Timestamp}_{RotationCount}.pcap

File with ‘curr_’ prefix is the file, that is currently being written to, which is still not closed. When files are to be rotated (depending on the file rotation parameters), file without the ‘curr_’ prefix are copied to hard disk.

The SMGR MonSub Session Id – This is the session Id for MonSub session created on Uplane SMGR instance ID, which created this PCAP. This Id is local to SMGR instance, so there could be two SLOWPATH pcap captured with same ID.

When files are to be copied to hard disk, the monsub_file_name_option_val is replaced by:

  • IMSI value if monitor-subscriber-file-name is set to "imsi".

  • Call ID value if monitor-subscriber-file-name is set to "call-id"

  • Username value if monitor-subscriber-file-name is set to ‘username’

Timestamp is in the following format "MMDDYYYYHHMMSS", where:

  • MM - Month, DD - Date and YYYY - Year.

  • HH -Hour, MM - Minutes and SS - Seconds.

RotationCount is a 9-digit value that is incremented every time an old file is rotated, and a new file is generated.

00000000 for the first file, 00000001 for the second file and so on.

Rotation of slowpath files is determined by following option in hexdump-module file configuration:

rotation { num-records number | time seconds| volume bytes }

  • num-records: num-records specifies the number of packets after which, a new file is generated and ‘RotationCount’ in the filename is incremented. The range of number is between 100 to 10240, and the default value is 1024.

  • time: time specifies the time to wait in seconds before a new file is generated and ‘RotationCount’ in the filename is incremented. seconds must be an integer from 30 through 86400. The default value is 3600.

  • volume: volume specifies the number of bytes after which a new file is generated and ‘RotationCount’ in the filename is incremented. bytes must be an integer from 51200 through 62914560. The default value is 102400.

Note

The tarriff-time parameter under rotation is ignored as it is not suitable for PCAP file capture.

The following are examples of the file naming conventions for slowpath PCAP files:

  • For the ‘imsi’ option where IMSI is ‘112233445566778’, slowpath files are named as:
    slowpath_S0_112233445566778_07152019050907_000000000.pcap
  • For ‘call_id’ option where Call Id is ‘01317b22’, slowpath files are named as:
    slowpath_S0_01317b22_07152019050907_000000000.pcap
Note

The parameter tarrif-time is not applicable for PCAP file capture.

Fastpath File Name Convention

The fastpath file names appear in the following format:

vpp_{S}_{B}_{encap}_{monsub_file_name_option}_{Timestamp}_{FileCount}.pcap
  • S is replaced by either ‘S1’, ‘S2’,'S3’, or 'S4’.

  • B is replaced by either ‘B0’,‘B1’,'B2', or 'B3' depending on the bundle generated by Panopticon.

  • monsub_file_name_option is replaced by:

    • IMSI value if monitor-subscriber-file-name is set to "imsi".

    • Call ID value if monitor-subscriber-file-name is set to "call-id"

    • Username value if monitor-subscriber-file-name is set to ‘username’

Timestamp is in the following format "MMDDYYYYHHMMSS", where:

  • MM - Month, DD - Date and YYYY - Year.

  • HH -Hour, MM - Minutes and SS - Seconds.

RotationCount is a 9-digit value that is incremented every time an old file is rotated, and a new file is generated.

00000000 for the first file, 00000001 for the second file and so on.

Fast path "FileCount" is not the same as the slowpath "RotationCount" parameters and hence ‘hexdump-module file rotation’ parameters are ignored while naming fastpath files.

In Phases 1 of the feature, fastpath generated file names are like ‘vpp_S1_B0_ip.pcap’ or ‘vpp_S1_B1_ip.pcap’, they are renamed to following when being copied over to non-volatile storage:

  • vpp_S1_B0_ip_01317b22_07152019050907_000000000.pcap
  • vpp_S1_B1_ip_01317b22_07152019050908_000000001.pcap
  • vpp_S1_B0_ip_01317b22_07152019050908_000000002.pcap

In MonSub phase 3, a PCAP “bundle” is replaced with a single PCAP file that uses Ethernet encapsulation.

In Phase 3, each fastpath session file is captured in the Ethernet PCAP file that is ‘vpp_S0_B0_eth.pcap’ and they are renamed to following when being copied to a non-volatile storage:

vpp_S0_B0_eth_01317b22_07152019050907_000000000.pcap

For ‘callid’ option where Call Id is ‘12345678ef’:

  • slowpath_S0_12345678ef _07152019050907_000000000.pcap
  • vpp_S1_B0_eth_12345678ef _07152019050907_000000000.pcap

For ‘username’ option where username is ‘9890098900’:

  • slowpath_S0_07152019050907_000000000_9890098900.pcap
  • vpp_S1_B0_eth_07152019050907_000000000_9890098900.pcap