How to Capture Traffic on PMF?

Asset ID:	1-71-2119294.1
Update Date:	2017-11-27
Keywords:

Solution Type Technical Instruction Sure

Solution 2119294.1 : How to Capture Traffic on PMF?

Applies to:

Oracle Communications Performance Intelligence Center (PIC) Software - Version 4.1 and later
Information in this document applies to any platform.

Goal

Capture traffic in order to analyze or replay it in lab environment.

This page explains how to capture Ethernet traffic on a PMF.

Solution

tcpdump capture

Root privileges are required to execute the following commands

Logon to the PMF server using your favorite ssh client.
Create a folder where you want to store the dumps from the network:
mkdir /tekelec/capture
Ensure that there is enough space left in the partition. If not, use another path/partition
Change the rights on this folder:
chmod 777 /tekelec/capture
Move to that directory:
cd /tekelec/capture
Capture traffic (as root):
tcpdump -i ethXX -s 1600 -C 100 -W 10 -w filename.dmp
Arguments explanations:
- -i: ethernet interface
- -s: MTU, 1600 is recommended value
- -C: The units of file_size are millions of bytes (1,000,000 bytes, not 1,048,576 bytes).
- -W: this will limit the number of files created to the specified number, and begin overwriting files from the beginning, thus creating a 'rotating' buffer.
- -w: file name

Filter an existing capture

It is sometimes required to filter a capture to make file smaller and analyzes easier.

tshark -r filename.dmp -R "m3ua.protocol_data_opc == 4220 || m3ua.protocol_data_dpc == 4220" -w filename_filtered.pcap

Argument explanations:

-r: existing capture file
-R: filter that can uses "Wireshark" syntax. Example used here filters on Point Code 4220.
-w: new output file

Capture TC

PIC 7.5 introduce the possibility to capture a TC. Go in CCM, Acquisition, on the PMF, in Traffic Classification, click Ethereal Capture Configuration

skdump

From a ssh console.

To enable SkDump, as cfguser:

iset -fvalue=1 LongParam where "name='PmiaSkDump'"

To disable SkDump:

iset -fvalue=0 LongParam where "name='PmiaSkDump'"

Captured file will named by TC (DbIpLink table) in /tmp or /tekelec/pm_socket in PIC 9.x.

Don't let any system with enabled skdump because it may lead to problem (partition filling, capture stop).

Multi interface capture in ramdisk

Attached script ethXcaptureRam.sh allows to capture up to 4 Ethernet interfaces at the same time in a RAM disk which is reducing risk of packet loss during capture.

Usage example (permits to capture during 15 seconds packets from eth31 eth34 eth33 eth32 in separated files and create a merged files with them):

# ./ethXcaptureRam.sh 15 eth31 eth34 eth33 eth32

Capture results are stored in /tekelec/TcpdumpCapture

Attachments

This solution has no attachment