config push pcap

  • Updated on Feb 24, 2025
  • Published on Feb 24, 2025
  • 5 minute(s) read
  • jM
 Prev Next

Commands for inspecting and changing the system’s push PCAP behavior.

show push pcap status

Prints the state of all entries in the push schedule.

show push pcap status

Example output:

[Sat Jan 25 05:48:16 2025] > show push pcap status
[Sat Jan 25 05:48:17 2025] FollowStart : true
[Sat Jan 25 05:48:17 2025] Decap       : true
[Sat Jan 25 05:48:17 2025]
[Sat Jan 25 05:48:17 2025] Name                           : Write Path                                             Suffix : Split Mode :   Filename : Filter Frame         : Filter BPF
[Sat Jan 25 05:48:17 2025] -------------------------------+---------------------------------------------------------------+------------+------------+----------------------+------------------------------------------
[Sat Jan 25 05:48:17 2025] pushtest                       : /mnt/store0/push                                              :    360 Sec :      -nsec :                      : (dst host 157.55.130.150)
[Sat Jan 25 05:48:17 2025] newpush                        :                                                               :   3600 Sec :  HHMMSS_TZ :                      : ()
[Sat Jan 25 05:48:17 2025] -------------------------------+---------------------------------------------------------------+------------+------------+----------------------+------------------------------------------

config push pcap add

Creates a new push target with a given name.

config push pcap add <target name>

Example output:

[Sat Jan 25 05:39:16 2025] > config push pcap add newpush
[Sat Jan 25 05:39:17 2025] Created Ring named [pcap_newpush]
cycle calibration disabled
null  output
RING reset
RING file [/opt/fmadio/queue/pcap_newpush]
RING[/opt/fmadio/queue/pcap_newpush                    ] Size missmatch 0 12595200
RING[/opt/fmadio/queue/pcap_newpush                    ] Size   : 12595200 16777216
RING[/opt/fmadio/queue/pcap_newpush                    ] Version:        0      100
RING[/opt/fmadio/queue/pcap_newpush                    ] version wrong force reset
RING[/opt/fmadio/queue/pcap_newpush                    ] Put:0 0 0x7ff85709e000
RING[/opt/fmadio/queue/pcap_newpush                    ] Get:0 0 0x7ff85709f000
[Sat Jan 25 05:39:17 2025] created ring [/opt/fmadio/queue/pcap_newpush]
[Sat Jan 25 05:39:17 2025] Add Push PCAP target [newpush]

config push pcap cpu

Set the CPU affinity that will be used by stream_cat for a push target.

config push pcap cpu <target name> <cpu number>

Example output:

[Sat Jan 25 05:53:20 2025] > config push pcap cpu newpush 13
[Sat Jan 25 05:53:20 2025] Set CPU [none] -> [13]

config push pcap del

Deletes a specific push target.

config push pcap del <target name>

Example output:

[Sat Jan 25 07:02:22 2025] > config push pcap del oldpush
[Sat Jan 25 07:02:23 2025] deleting: [oldpush] row 2

config push pcap del_all

Deletes all push targets.

config push pcap del_all

Example output:

[Sat Jan 25 07:02:36 2025] > config push pcap del_all

config push pcap filename

Change the template used to generate the names given to files written by a push target.

Available formats:

  • epoch-sec → e.g. FileName <name>_1654610221.pcap

  • epoch-sec-startend → e.g. FileName <name>_1654610221-1654620221.pcap

  • epoch-msec → e.g. FileName <name>_1654610221012.pcap

  • epoch-usec → e.g. FileName <name>_1654610221012345.pcap

  • epoch-nsec → e.g. FileName <name>_1654610221012345678.pcap

  • HHMM → e.g. FileName <name>_20200101_1201.pcap

  • HHMMSS → e.g. FileName <name>_20200101_120159.pcap

  • HHMMSS_TZ → e.g. FileName <name>_2020-01-01_12:01:59+09:00.pcap

  • HHMMSS_NS → e.g. FileName <name>_20200101_120159.012.345.678.pcap

  • HHMMSS_SUB → e.g. FileName <name>_20200101_120159.012345678.pcap

config push pcap filename <target name> <format>

Example output:

[Sat Jan 25 06:08:29 2025] > config push pcap filename newpush epoch-usec
[Sat Jan 25 06:08:30 2025] Set Filename to  [--filename-tstr-HHMMSS_TZ] -> [--filename-epoch-usec]

config push pcap filter-bpf

Add a Berkeley Packet Filter (BPF) to a given push target to dictate which packets pass through stream_cat.

Note that you cannot use whitespace in the filter unless it is surrounded by double quotation marks. Single quotation marks are not supported.

config push pcap filter-buf <target name> "<BPF>"

Example output:

[Sat Jan 25 06:09:27 2025] > config push pcap filter-bpf newpush "greater 900"
[Sat Jan 25 06:09:32 2025] Set FilterBPF [] -> [greater 900]

config push pcap filter-frame

Add a frame filter to a given push target to dictate which packets pass through stream_cat.

Note that you cannot use whitespace in the filter unless it is surrounded by double quotation marks. Single quotation marks are not supported.

config push pcap filter-frame <target name> "<frame filter>"

Example output:

[Sat Jan 25 06:19:22 2025] > config push pcap filter-frame newpush "capture.port == 555"
[Sat Jan 25 06:19:22 2025] Set FilterFrame [greater 900] -> [capture.port == 555]

config push pcap name

Set a new name for a push target.

config push pcap name <target name> <new name>

Example output:

[Sat Jan 25 07:02:09 2025] > config push pcap name newpush oldpush
[Sat Jan 25 07:02:09 2025] Rename [newpush] -> [oldpush]

config push pcap path

Set a new write directory for a push target.

config push pcap path <target name> <write path>

Example output:

[Sat Jan 25 06:21:38 2025] > config push pcap path newpush /mnt/store0/push
[Sat Jan 25 06:21:38 2025] Set Path [] -> [/mnt/store0/push]

config push pcap restart

Restart the push_pcap.lua process and all its child processes, and then wait for them all to be brought back up again.

config push pcap restart

Example output:

[Mon Feb 24 04:45:46 2025] > config push pcap restart
Killing 7201 /opt/fmadio/bin/stream_cat
Killing 7204 /opt/fmadio/bin/pcap_split
wait for respawn 0/120
wait for respawn 1/120
wait for respawn 2/120
wait for respawn 3/120
wait for respawn 4/120
wait for respawn 5/120
process respawned

config push pcap split-size

The output of a stream_cat process run by a push target goes to a file in the write directory until either a certain interval of time has been observed over the packets’ timestamps or a certain cumulative capture length has been observed over the packets. This command sets a size threshold.

The given size amount must be an integer, optionally suffixed by upper-case M (megabytes) or G (gigabytes). If there is no suffix, the amount is taken as being in bytes.

Please note that the setting controlled by this command is also controlled by config push pcap split-time; these commands are mutually exclusive, and override each other.

config push pcap split-size <target name> <size>

Example output:

[Sat Jan 25 06:32:58 2025] > config push pcap split-size newpush 10G
[Sat Jan 25 06:32:59 2025] Set Split to  [--split-time 3600e9] -> [--split-byte 10000000000]

config push pcap split-time

The output of a stream_cat process run by a push target goes to a file in the write directory until either a certain interval of time has been observed over the packets’ timestamps or a certain cumulative capture length has been observed over the packets. This command sets a size threshold.

The given time amount must be an integer suffixed by lower-case s (seconds), m (minutes), or h (hours).

Please note that the setting controlled by this command is also controlled by config push pcap split-size; these commands are mutually exclusive, and override each other.

config push pcap split-time <target name> <time>

Example output:

[Sat Jan 25 06:40:50 2025] > config push pcap split-time newpush 1h
[Sat Jan 25 06:40:51 2025] Set Split to  [--split-byte 10000000000] -> [--split-time 3600000000000]