Capturing in PCAP Format

Configure TimestampFormat and PacketDescriptor to capture frames in pcap format.

1. Edit ntservice.ini file.

   vim /opt/napatech3/config/ntservice.ini

   The following shows the default TimestampFormat and PacketDescriptor configuration.

   TimestampFormat = NATIVE_UNIX
   PacketDescriptor = NT

   The NT descriptor is used by default when the SmartNIC delivers frames to the host. To capture frames with a PCAP descriptor, set PacketDescriptor to PCAP.

   PacketDescriptor = PCAP

   As the PCAP descriptor can only be used with the PCAP or PCAP_NS time stamp format, set TimestampFormat to PCAP or PCAP_NS. For example:

   TimestampFormat = PCAP

   ntservice must be stopped and restarted for changes to take effect.

   /opt/napatech3/bin/ntstop.sh
   /opt/napatech3/bin/ntstart.sh

   See ntservice.ini for more information about the configuration parameters in the ntservice.ini file.

2. Start capture.

   /opt/napatech3/bin/capture -p 0 -f test.pcap

   Note: The command line options are:

   • -p0: Capture frames that are received on port 0.
   • -f test.pcap: Store received frames to the test.pcap file.

   An output example:

   The ports are located on a Capture profile.
   Assigning traffic to stream 0
   >>> : Assign[streamid=0;TxPort=0;TxNow=False]=Port==0
   >>> : NT_NTPL returned id 4
   Capturing using timeout = 1000 [ms] of NT_NetRxGet()
   Capturing using segment interface.
   Capturing to file "test.pcap"
   Measuring PCIe throughput.
   Throughput:    0.000 Mbps

3. Start transmitting frames on the traffic generator.
4. Stop capture.
   An output example.

   The ports are located on a Capture profile.
   Assigning traffic to stream 0
   >>> : Assign[streamid=0;TxPort=0;TxNow=False]=Port==0
   >>> : NT_NTPL returned id 4
   Capturing using timeout = 1000 [ms] of NT_NetRxGet()
   Capturing using segment interface.
   Capturing to file "test.pcap"
   Measuring PCIe throughput.
   ^CThroughput:    0.000 Mbps
   Delete the NTPL assigns.
   >>> : Delete=4
   Average throughput:   10.967 Mbps.
   
   Total: 5 segments, 7988736 bytes, 0 bytes dropped, 0 packets dropped

5. Examine the generated test.pcap file using a libpcap application such as wireshark or tshark.
   For example:

   tshark -r test.pcap