Net Traffic Imaging Notes - Logicube Falcon-NEO User Manual

Segment Size – Allows the user to set the size of the captured segment (pcapng file). The
•
options available are 2 GB, 4 GB, 8 GB, 16 GB, and Whole Disk.
Number of Segments – Allows the user to select how many segment files to create. For
•
example, if the Segment Size is set to 4 GB and the Number of Segments is set to 2, two
segment files will be created. The options available are: 2, 4, 8, 16, and Whole Disk.
Segment Ring Buffer – This setting determines what the Falcon-NEO will do when it
•
reaches the total number of segments.
ON – When this is set to ON, the Falcon-NEO will continuously capture network
▪
traffic until the task is aborted. For example, if the Number of Segments is set to 2
and the Segment Ring Buffer is set to ON, after the 2
delete the 1
first segment file.
OFF – When this is set to OFF, once the Falcon-NEO reaches the number of
▪
segments set, it will stop the task.

11.2 Net Traffic Imaging notes

Depending on the settings chosen, the Net Traffic to File task may finish and stop on its
•
own. The Number of Segments determines how many segment files (how many pcapng
files) will be written. When the Ring Buffer setting is set to ON, the Falcon-NEO will
complete the Number of Segments set, then delete the first segment and continue
capturing network traffic. When Ring Buffer is set to ON, the user will continue to
capture network traffic until the task is aborted by the user.
Capturing network traffic is dependent on how each network is setup. By simply
•
connecting the Falcon-NEO to a network, the Falcon-NEO could capture all traffic
forwarded by the Ethernet switch to the given port. Capturing network traffic from a
specific IP address requires advanced networking knowledge. For example, a managed
Logicube Falcon -Neo User's Manual
®
segment, then continue capturing network traffic, and create a new
st
NET TRAFFIC
segment is finished, it will
nd
118