Avalanche: When the packet trace buffer fills up, does capture stop or does it wrap (i.e., use a circular buffer)?

Question

question

mkanada asked May 16, '14 landyzhou answered May 26, '14

Avalanche: When the packet trace buffer fills up, does capture stop or does it wrap (i.e., use a circular buffer)?

When I check "Enable Client Packet Trace" and the test has more packets than the capture buffer can hold, does capture stop or does it wrap?

Avalanche capture

10 |950

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Answer 1 · 2014-05-16T15:59:57Z

LBalcerak answered May 16, '14

I would be careful calling the Flight Recorder a "Circular Buffer", this sets unobtainable expectations. If, you have an issue midway through a longer test (20 minutes), Avalanche Capture will not be able to capture this middle portion, only the beginning and the very end of the test run. You will have to mirror the ports on your device and use an external capture tool such as Wireshark.

10 |950

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Answer 2 · 2014-05-26T15:18:30Z

landyzhou answered May 26, '14

Normally, I will access to appliance, change directly to /swat/tests, and user command "rm -r *" to clear all run/configure data.

10 |950

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Answer 3 · 2014-05-16T06:32:58Z

acastaner answered May 16, '14

No circular buffer for the Client/Server Packet Trace - it'll record the first 50 megabytes (or whatever value you configured) of traffic then stop recording. However if you turn on the Flight Recorder that feature will use a circular buffer, that is, record the last 1000 packets.

10 |950

Attachments: Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

question