Flow Capture; Limitations - Cisco SCE 8000 10GBE Software Configuration Manual

Chapter 4 Utilities

Flow Capture

•
•
The flow capture utility is a CLI-controlled utility that is used to capture traffic according to Layer 4
attributes.
The traffic flow captured by this utility is accumulated in a cap format file. Traffic that is identified by
the capture mechanism is not available for traffic control or any other service for the duration of the
capture. When flow capture is configured, the traffic that matches the rules are bypassed on Cisco SCE.
After the completion of a capture, normal service to all the traffic is resumed.
The recorded data is sent online to a distant location using FTP. The data is sent in a standard format,
with a maximum file size of 128 MB on the Cisco SCE 8000 platform (configurable by a const DB).
In Cisco SCE 8000 that has two SCM modules, a separate cap file is created by each SCM module, each
with a maximum file size of 64 MB.
Flow capture is used for troubleshooting. Enabling the flow capture may impact the CPU performance.
Note
We recommend that you avoid enabling flow capture in a production environment.

Limitations

Note the following known limitations of the flow capture utility:
•
•
•
•
•
•
•
OL-30621-02
Limitations, page 4-17
The Flow Capture Process, page 4-18
The actual capture starts only for newly opened flows. Therefore, already opened flows cannot be
captured by this utility.
The termination of a capture flow is verified for every new relevant packet that is being captured.
As long as no packets matching the capturing attributes arrives after the time is exceeded, the
capturing is not stopped and must be stopped manually.
File size limitation: the maximum captured file size is limited on Cisco SCE 8000 platform to
128MB (configurable by a const DB). In this platform the FTP connection is opened when the
capturing starts, but the data is first kept on the system disk and is transferred to the FTP destination
only when the capturing procedure is concluded.
In a system with two Cisco SCE 8000-SCM modules, which creates two capture files, the maximum
file size for each file is 64MB, for a total of 128MB.
FTP timeout: As the recorded traffic might be sparse, and since on the Cisco SCE 8000 platform the
data is sent only upon termination of the capture, it is required to disable any connection timeout on
the destination FTP server.
Capture may end prematurely due to a shortage event on the Cisco SCE platform.
Capturing throughput is limited by the following:
system architectural limitations
–
line capacity to the remote FTP destination (for non-Linux platforms only, such as the Cisco
–
SCE 2000 platform).
The approximated throughput on a live setup is 2Mbps. When this throughput is exceeded, packets
are absent from the cap file and the appropriate field in the consequent captured packet is updated
to note the number of lost packets. The maximum allowed number of sequential lost packets is
configurable by a const DB.
Cisco SCE 8000 10GBE Software Configuration Guide
Flow Capture
4-17