pi-list icon indicating copy to clipboard operation
pi-list copied to clipboard

Add a method to record pcap files with a PC

Open jakkul opened this issue 1 year ago • 1 comments

Hey! I fully understand that this is not really possible to record a pcap file with a laptop, but there is certain equipment out there available, that can turn your PC into a pcap recording machine.

I can help putting together a howto that says how to do it. I know how to do it with Mellanox ConnectX-4 and newer cards. It turns out that Nvidia's OFED drivers just do the job perfectly. After installing the drivers and configuring a network card, one must:

  • sync the time using PTP
  • join the multicast with the 2110 stream

ip addr add MULTICAST-IP/32 dev NETWORK-INTERFACE autojoin

  • just record it with tcpdump with following options

chrt -rr 99 taskset -c 5 tcpdump -i NETWORK-INTERFACE -s 65535 -w YOUR-PCAP.pcap -c 100000 --time-stamp-precision=nano -j adapter_unsynced udp and "dst MULTICAST-IP"

Don't forget to drop the multicast afterwards.

So if it's OK to add a howto on this - please let me know where should I put it, I'll do something longer and create a pull request with that.

jakkul avatar Apr 11 '24 09:04 jakkul