Targa Systems DivisionS4 Ethernet NAS DTS Installation Guide 32003272-1 Rev 5F Network Data Capture FunctionWith F/W version 3.1.8 and above, the Targa Series 4 NAS DTU has the ability tolog network traffic to the removable Data Transfer Device (DTD). This capabilityuses tcpdump v4.1.1 (www.tcpdump.org) to capture information from the networkin a libpcap v1.1.1 format that can be later replayed by tools such as tcpdump orWireshark (www.wireshark.org).The feature is activated if a special control file “netcapture.cfg” is found on/dtd/a/part1 when mounted (as well as /dtd/b/part1 in a dual DTD system). Trafficcan be captured from port1, port2 or both ports simultaneously. Network captureoperations are specified within the “netcapture.cfg” file as defined below.The network capture can store data to encrypted volumes, however they must firstbe unlocked via the standard SSH mechanism before the capture service canbegin.High-rate network transfers to/from the DTU while doing network capture will affectoverall performance of transfers due to the DTU writing network packet data to theDTD in addition to the "normal" requirements of the network transfer.“netcapture.cfg” Configuration fileThe netcapture.cfg file is a simple text file located on partition1 of the DTD wheredata is to be stored. Configurable parameters are as specified below, where x (=0;1) specifies the ethernet port. Targa Systems recommends that when initiallypreparing the netcapture.cfg file you set the DTU COM2 monitor “verbosity” to“high” and then monitor the output during DTU start up.Note: Network data capture will not start if:- DTD door is open- DTD is not installed- netcapture specified target directory are encrypted and not unlocked.- netcapture specified target directory does not existnetcapture – Basic ActivationETHx_NC_ENABLE=yes Start netcapture on specified portwhere x = 0 for port 1; x=1 for port 2Defaults:Capture All traffic on the wire (in switched ethernet environments this isoften just broadcast traffic and traffic destined to the DTU)Into Directory: Partition #1 of the DTD on which the netcapturefile was foundInto Filename: nc-ethX-runY.pcapZwhere: X = 0 for port1 X = 1 for port2Y = 1 to n; Upon DTD re-mount, if file found Y = Y+1, else Y=1Z = “null” to n; capture file size limited to 1GB, auto increments49