--- title: "config push pcap" slug: "config-push-pcap" updated: 2025-02-24T06:37:13Z published: 2025-02-24T06:37:13Z canonical: "docs.fmad.io/config-push-pcap" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.fmad.io/llms.txt > Use this file to discover all available pages before exploring further. # config push pcap Commands for inspecting and changing the system’s [push PCAP](/v1/docs/push-pcap-automatic) behavior. --- ## show push pcap status Prints the state of all entries in the push schedule. ```plaintext show push pcap status ``` Example output: ```plaintext [Sat Jan 25 05:48:16 2025] > show push pcap status [Sat Jan 25 05:48:17 2025] FollowStart : true [Sat Jan 25 05:48:17 2025] Decap       : true [Sat Jan 25 05:48:17 2025] [Sat Jan 25 05:48:17 2025] Name                           : Write Path                                             Suffix : Split Mode :   Filename : Filter Frame         : Filter BPF [Sat Jan 25 05:48:17 2025] -------------------------------+---------------------------------------------------------------+------------+------------+----------------------+------------------------------------------ [Sat Jan 25 05:48:17 2025] pushtest                       : /mnt/store0/push                                              :    360 Sec :      -nsec :                      : (dst host 157.55.130.150) [Sat Jan 25 05:48:17 2025] newpush                        :                                                               :   3600 Sec :  HHMMSS_TZ :                      : () [Sat Jan 25 05:48:17 2025] -------------------------------+---------------------------------------------------------------+------------+------------+----------------------+------------------------------------------ ``` --- ## config push pcap add Creates a new push target with a given name. ```plaintext config push pcap add ``` Example output: ```plaintext [Sat Jan 25 05:39:16 2025] > config push pcap add newpush [Sat Jan 25 05:39:17 2025] Created Ring named [pcap_newpush] cycle calibration disabled null  output RING reset RING file [/opt/fmadio/queue/pcap_newpush] RING[/opt/fmadio/queue/pcap_newpush                    ] Size missmatch 0 12595200 RING[/opt/fmadio/queue/pcap_newpush                    ] Size   : 12595200 16777216 RING[/opt/fmadio/queue/pcap_newpush                    ] Version:        0      100 RING[/opt/fmadio/queue/pcap_newpush                    ] version wrong force reset RING[/opt/fmadio/queue/pcap_newpush                    ] Put:0 0 0x7ff85709e000 RING[/opt/fmadio/queue/pcap_newpush                    ] Get:0 0 0x7ff85709f000 [Sat Jan 25 05:39:17 2025] created ring [/opt/fmadio/queue/pcap_newpush] [Sat Jan 25 05:39:17 2025] Add Push PCAP target [newpush] ``` --- ## config push pcap cpu Set the CPU affinity that will be used by stream_cat for a push target. ```plaintext config push pcap cpu ``` Example output: ```plaintext [Sat Jan 25 05:53:20 2025] > config push pcap cpu newpush 13 [Sat Jan 25 05:53:20 2025] Set CPU [none] -> [13] ``` --- ## config push pcap del Deletes a specific push target. ```plaintext config push pcap del ``` Example output: ```plaintext [Sat Jan 25 07:02:22 2025] > config push pcap del oldpush [Sat Jan 25 07:02:23 2025] deleting: [oldpush] row 2 ``` --- ## config push pcap del_all Deletes all push targets. ```plaintext config push pcap del_all ``` Example output: ```plaintext [Sat Jan 25 07:02:36 2025] > config push pcap del_all ``` --- ## config push pcap filename Change the template used to generate the names given to files written by a push target. Available formats: - `epoch-sec` → e.g. `FileName <name>_1654610221.pcap` - `epoch-sec-startend` → e.g. `FileName <name>_1654610221-1654620221.pcap` - `epoch-msec` → e.g. `FileName <name>_1654610221012.pcap` - `epoch-usec` → e.g. `FileName <name>_1654610221012345.pcap` - `epoch-nsec` → e.g. `FileName <name>_1654610221012345678.pcap` - `HHMM` → e.g. `FileName <name>_20200101_1201.pcap` - `HHMMSS` → e.g. `FileName <name>_20200101_120159.pcap` - `HHMMSS_TZ` → e.g. `FileName <name>_2020-01-01_12:01:59+09:00.pcap` - `HHMMSS_NS` → e.g. `FileName <name>_20200101_120159.012.345.678.pcap` - `HHMMSS_SUB` → e.g. `FileName <name>_20200101_120159.012345678.pcap` ```plaintext config push pcap filename ``` Example output: ```plaintext [Sat Jan 25 06:08:29 2025] > config push pcap filename newpush epoch-usec [Sat Jan 25 06:08:30 2025] Set Filename to  [--filename-tstr-HHMMSS_TZ] -> [--filename-epoch-usec] ``` --- ## config push pcap filter-bpf Add a [Berkeley Packet Filter](https://www.ibm.com/docs/en/qsip/7.4?topic=queries-berkeley-packet-filters) (BPF) to a given push target to dictate which packets pass through stream_cat. Note that you cannot use whitespace in the filter unless it is surrounded by double quotation marks. Single quotation marks are not supported. ```plaintext config push pcap filter-buf "" ``` Example output: ```plaintext [Sat Jan 25 06:09:27 2025] > config push pcap filter-bpf newpush "greater 900" [Sat Jan 25 06:09:32 2025] Set FilterBPF [] -> [greater 900] ``` --- ## config push pcap filter-frame Add a [frame filter](/v1/docs/frame-filters) to a given push target to dictate which packets pass through stream_cat. Note that you cannot use whitespace in the filter unless it is surrounded by double quotation marks. Single quotation marks are not supported. ```plaintext config push pcap filter-frame "" ``` Example output: ```plaintext [Sat Jan 25 06:19:22 2025] > config push pcap filter-frame newpush "capture.port == 555" [Sat Jan 25 06:19:22 2025] Set FilterFrame [greater 900] -> [capture.port == 555] ``` --- ## config push pcap name Set a new name for a push target. ```plaintext config push pcap name ``` Example output: ```plaintext [Sat Jan 25 07:02:09 2025] > config push pcap name newpush oldpush [Sat Jan 25 07:02:09 2025] Rename [newpush] -> [oldpush] ``` --- ## config push pcap path Set a new write directory for a push target. ```plaintext config push pcap path ``` Example output: ```plaintext [Sat Jan 25 06:21:38 2025] > config push pcap path newpush /mnt/store0/push [Sat Jan 25 06:21:38 2025] Set Path [] -> [/mnt/store0/push] ``` --- ## config push pcap restart Restart the push_pcap.lua process and all its child processes, and then wait for them all to be brought back up again. ```plaintext config push pcap restart ``` Example output: ```plaintext [Mon Feb 24 04:45:46 2025] > config push pcap restart Killing 7201 /opt/fmadio/bin/stream_cat Killing 7204 /opt/fmadio/bin/pcap_split wait for respawn 0/120 wait for respawn 1/120 wait for respawn 2/120 wait for respawn 3/120 wait for respawn 4/120 wait for respawn 5/120 process respawned ``` --- ## config push pcap split-size The output of a stream_cat process run by a push target goes to a file in the write directory until either a certain interval of time has been observed over the packets’ timestamps or a certain cumulative capture length has been observed over the packets. This command sets a size threshold. The given size amount must be an integer, optionally suffixed by upper-case `M` (megabytes) or `G` (gigabytes). If there is no suffix, the amount is taken as being in bytes. Please note that the setting controlled by this command is also controlled by `config push pcap split-time`; these commands are mutually exclusive, and override each other. ```plaintext config push pcap split-size ``` Example output: ```plaintext [Sat Jan 25 06:32:58 2025] > config push pcap split-size newpush 10G [Sat Jan 25 06:32:59 2025] Set Split to  [--split-time 3600e9] -> [--split-byte 10000000000] ``` --- ## config push pcap split-time The output of a stream_cat process run by a push target goes to a file in the write directory until either a certain interval of time has been observed over the packets’ timestamps or a certain cumulative capture length has been observed over the packets. This command sets a size threshold. The given time amount must be an integer suffixed by lower-case `s` (seconds), `m` (minutes), or `h` (hours). Please note that the setting controlled by this command is also controlled by `config push pcap split-size`; these commands are mutually exclusive, and override each other. ```plaintext config push pcap split-time