RPCAP (Remote Packet Capture) system provides the ability to remotely capture the packets being passed over the network allowing the remote control and analysis of the transit data flows.
RPCAP system consists of a server side daemon and a client side application. The client application (for example, packet analyzer) connects to the server daemon, gives instructions which packets should be captured and manages the whole process. The server daemon sniffs the network traffic, captures the requested packets and passes them to the client side that process and analyze the captured packets.
The IW device supports RPCAP protocol and has a built-in RPCAP server daemon. It can be enabled and configured using the “rpcapd” command described below.
Syntax:
rpcapd -user=USERNAME -key[=PASSWORD] [add|del|change]
rpcapd [-port[=PORT]] [-maxconn[=MAXCONNECTIONS]] [start|stop]
rpcapd [-buffersize=[SND_BUFFER_SIZE]]
rpcapd {trace|notrace}
rpcapd show [-s=SOURCENAME]
rpcapd clear
To start/stop the RPCAP server daemon use the following command:
rpcapd [-port[=PORT]] [-maxconn[=MAXCONNECTIONS]] [start|stop]
When started without any arguments ("rpcapd start") it sets the default RPCAP port value (2002) and unlimited number of allowed client connections. To specify another values “port” and “maxconn” parameters are used.
The following command adds/deletes/changes a username and password to be used by the client to connect to the RPCAP server:
rpcapd -user=USERNAME -key[=PASSWORD] [add|del|change]
When used without specifying the action (i.e. without “add”, “del” and “change”) the command adds a new user or changes the existing user with the same “username”.
NOTE
If no user is configured in the system the RPCAP server daemon will reject any connections.
For using Null Authentication scheme you should add a user with empty “user” and “key” parameters: “rpcapd –user= -key=”.
The following command allows specifying the internal buffer size of the daemon for sending the captured packets to the client application:
rpcapd [-buffersize=[SND_BUFFER_SIZE]]
The default buffer size is 32Kb.
The following command enables/disables writing daemon debug output to the unit’s system log:
rpcapd {trace|notrace}
The following command allows viewing all the currently active connections:
rpcapd show [-s=SOURCENAME]
Parameter “-s” allows viewing the BPF filter of the connection with the specified device’s interface name (SOURCENAME).
To clear the configuration and stop the daemon use the following command:
rpcapd clear