Data Capture Files

rvtrace can write packets into a capture file, and read a stream of packets from a file (as if from the network).

Motivation

Packet capture files are an important tool for problem diagnosis. Several techniques are useful:

Capture packet data for later analysis.
Capture packet data for further analysis at a remote location.
Capture packets at high speed, then replay later when I/O delays are acceptable.

In general, rvtrace can capture packets to a file faster than it can display statistics. Large amounts of display data can create I/O delays, which could cause rvtrace to miss packets. For example, in a heavily loaded network, displaying subject statistics for many subjects could have this undesirable result.

You can use data capture files to side-step this difficulty. For example, capture a five-minute snapshot of packets (capturing suppresses display); then replay packets from the file, displaying statistics when the consequences of I/O delays are no longer problematic.

Output File Rotation

The rotation regimen for data capture output is almost identical to the rotation regiment for log files; see Log Rotation.

The only difference between them, is that rvtrace always deletes an older existing file before opening a file for writing packet data. (That is, it never appends to the end of an existing data capture file.)

Output Rotation Backward Compatibility

 

The command line option -w-rotate total_size is deprecated in release 7.5, and will become obsolete in a subsequent release. We recommend migrating to the new rotation parameters at your earliest convenience.

In the meantime, we preserve backward compatibility by converting the value of this deprecated parameter to corresponding values of the new parameters:

-w-rotate total_size retains its old meaning—specifying the total size for all data capture files. The maximum size for each individual file in the rotation is total_size/10.
If both old and new parameters are present, the new parameters take precedence (overriding the old parameter).