How can I perform a timed packet capture on a PacketShaper?

Products

• PacketShaper

Issue/Introduction

Example: You want to perform a 60-second packet capture as part of an Adaptive Response action file.  When the agent fires and turns red, you would like to have the PacketShaper automatically take a 60-second packet capture of traffic in the class which the agent monitors. 

 

There is not a sleep or timer command on the PacketShaper.  One way around this would be to insert a command which takes a fixed amount of time to respond as a replacement for a sleep command.  Assuming the PacketShaper is keyed for compression and is running an 8.x Standard build, one could use  the tunnel ping CLI command as a sleep command.  No tunnel configuration is needed and local host (127.0.0.1) could be used as the target for the tunnel ping.  

 

tunnel ping main 127.0.0.1 64 1        (this would send 1 tunnel ping to local host)

tunnel ping main 127.0.0.1 64 10       (this would send 10 tunnel pings to local host)

 

Both pings will fail in fixed amount of time.  6 seconds for the single tunnel ping and 15 seconds for 10 tunnel pings.

 

Using that information, a command file to take a 60-second packet capture on Inbound/default and send email notification could look like this: 

 

#Title: Red action file for packet capture on /inbound/default

send email [email protected] "$agentname agent turned red" "Packet Capture was taken on the class /inbound/default"

pac add class:inbound/default

pac on

tun ping main 127.0.0.1 64 10

tun ping main 127.0.0.1 64 10

tun ping main 127.0.0.1 64 10

tun ping main 127.0.0.1 64 10

pac off

pac remove class:inbound/default

 

 The four tunnel ping commands will take a total of 60 seconds to time out and the packet capture will be stopped after 60 seconds.