Napatech

First Installation

Steps

• download latest Napatech drivers and untar it into e.g. /opt/napatech3
• build the driver
• download the the sniffer's source

cd /usr/src
git clone -b master https://github.com/voipmonitor/sniffer.git
   OR
git clone -b develop https://github.com/voipmonitor/sniffer.git
cd sniffer
./configure --with-dpdk-include=/opt/napatech3/include --with-dpdk-lib=/opt/napatech3/lib

Install all libraries that the configure needs.

• run make
• check it's built properly

root@server:/usr/src/sniffer# ldd ./voipmonitor | grep pcap
	libpcap.so.1 => /opt/napatech3/lib/libpcap.so.1 (0x00007fc0b69b0000)

• replace original binary in the /usr/local/sbin
• run it

Upgrade

The GUI way (from the sensor's version 24.23)

Until sensor's version 24.23 was not possible to do the sensor's upgrade via 'upgrade_by_git' option because the configure script overwritten the adjusted Makefile and you built a binary with standard pcap libs (until you overwritten the orig libs). With 'configure_param' option you can adjust the Makefile creation for appropriate includes/libs

• set these options into voipmonitor.conf

upgrade_by_git = yes
git_folder = /usr/src/sniffer
configure_param = --with-dpdk-include=/opt/napatech3/include --with-dpdk-lib=/opt/napatech3/lib

• restart sniffer
• do the upgrade via clicking in the GUI

The sniffer will perform (after click on UPGRADE in GUI) git pull,configure,make_clean,make, service voipmonitor stop, make install, service voipmonitor start.

The manual way

cd /usr/src/sniffer
git pull
make

• copy to the original directory and restart sensor

napatech drivers

Settings sample

• in voipmonitor.conf

interface = napa0

# filter option must be commented out !!! E.g.
#filter = udp or (vlan and udp)

• /opt/napatech3/config/ntpcap.ini

# Napatech default ntpcap.ini file
[Common]
Ntpl1 = "Assign[streamid=0;txport=0;txignore=true]=all"

[napa0 ]
StreamId = 0
Tx = 0

• old version

[napa0]
Rx1="Assign[streamid=252;txport=0;txignore=true]=all"
Tx=0

• /opt/napatech3/config/ntservice.ini

[System]
TimestampFormat = NATIVE_UNIX
TimestampMethod = EOF 
HostBufferWaitMethod = 0 
SDRAMFillLevelWarning = 0

[logging]
LogMask = 0x07
LogToFile = 0
LogFileName = /tmp/Log3G_%s.log
LogBufferWrap = wrap

[Adapter0]
AdapterType = NT4E
BusId = 00:07:00:00
PacketDescriptor = NT
HostBuffersRx = [8,16,0]
HostBuffersTx = [8,16,0]
TimeSyncProtocol = NT
TimeSyncConnectorIn = Ext
TimeSyncConnectorOut = None
TimeSyncConnectorRepeat = None
TimeSyncTimeJumpThreshold = 1
TimeSyncTimeOffset = 0
MaxFrameSize = 9018
AltTPID = 0x8100
Profile = Capture
DiscardSize = 16
OsTimeSyncFailover = DISABLE

Timing source In napatech where timestamp of packets is shifted to GMT and you want use system time instead: GMT:

TimeSyncConnectorExt1 = PpsIn

System dependent:

TimeSyncConnectorExt1 = NttsIn

For new napatech drivers use following to set OS time for packets from napatech

TimesynConnectorExt1  = None 
TimeSyncReferencePrioroity =OSTime

Hints

Filter traffic on Napatech card

If you want to filter a data directly in the Napatech card you can use this example as a starting point. (many thanks to Distributel for the example)

Create a file e.g /opt/napatech3/myfilter.ntpl

# Start NTPL
# Delete all existing filter
delete = all

# Setup UDP macros

DefineMacro("mUdpSrcPort", "Data[DynOffset=DynOffUDPFrame;Offset=0;DataType=ByteStr2]")
DefineMacro("mUdpDestPort", "Data[DynOffset=DynOffUDPFrame;Offset=2;DataType=ByteStr2]")

# Setup filters
# The first line is the SIP filter. The second line is the RTP filter for our specific ports in HEX (10000-61743)

Assign[StreamId = 0] = (mUdpSrcPort == 5060, 5061) AND (mUdpDestPort == 5060, 5061)
Assign[StreamId = 0] = (mUdpSrcPort == (0x2710..0xF12F))
Assign[StreamId = 1] = (mUdpSrcPort == 5060, 5061) AND (mUdpDestPort == 5060, 5061)
Assign[StreamId = 1] = (mUdpSrcPort == (0x2710..0xF12F))
Assign[StreamId = 2] = (mUdpSrcPort == 5060, 5061) AND (mUdpDestPort == 5060, 5061)
Assign[StreamId = 2] = (mUdpSrcPort == (0x2710..0xF12F))
Assign[StreamId = 3] = (mUdpSrcPort == 5060, 5061) AND (mUdpDestPort == 5060, 5061)
Assign[StreamId = 3] = (mUdpSrcPort == (0x2710..0xF12F))
# End NTPL

# Enable Deduplication
DeduplicationConfig[drop=duplicate] = GroupID == 0
Define ckRecipe = CorrelationKey(Begin=StartOfFrame[0], End=EndOfFrame[0], DeduplicationGroupID=0)
Assign[StreamID=0,1,2,3; CorrelationKey=ckRecipe] = Port == 0,1,2,3

Start it with the command

/opt/napatech3/bin/ntstart.sh -n myfilters.ntpl