TSP Lab GyTapper – Common features GyTapper

GyTapper – Common features)

Table of Contents

Logging

 The module creates daily logfiles about its operation. The name of the logfile is "modulename_YYYYMMDD.log", reflecting the day when it is created.
The module can write information into the logfile and onto the screen at various detail levels, set by the [Log]/Details menu item. The logging level can be: Status line counters are logged in every fifteen minutes irrespectively of logging level actually set.

The color coding of the log lines have the following meaning:

Code Color Usage
0 Black Compact data record
1 Red Errors
2 Green Open/close output file/stream
3 Blue Open/close input file/stream
4 Yellow Warnings
5 Light Grey Detailed data (debug info)
6 Dark Grey Detailed data (user info)
7 Purple Operator intervention;
Errors with emphasis

The web-interface

Common part

The GyTapper modules provide a useful web-interface to follow its operation remotely in an easy way. Views of the web-interface: Views can be accessed by typing the following addresses into the address bar of a web browser or directly from the GUI pressing the WIF button: Views can also be accessed from any of the other views by clicking on the proper link at the top of the view page.

The status of GyTapper modules

Distribution filtering rules

 The GyTapper modules receive the packets from capture cards or other capture modules and forwards them to the monitors with the proper three-character LinkID applying various distribution filtering rules.

The following rules can be specified:

The evaluation of the rules follows the "top-to-bottom" and "first-match" principles. The packet evaluation process is the following: The packet evaluation process described above is the same if IP address names are given instead of IP addresses, and if the IP address name definition (e.g.: "IPAddrNames2.csv") contains port definition, as well.

Statistics and events sent by the GyTapper modules to the Poller

Statistics:

StatID Description
9000 Number of bytes received on a PCAP interface identified with the LinkID.
9001 Number of packets received on a PCAP interface identified with the LinkID.

Events:

EventID Description Type of event Meaning
9000 Event queue is full. ERROR This event is generated when the number of events waiting in the sending queue is 99.
9001 Connection is up. MESSAGE Status of the interface has changed to 'up'. The interface is identified by the LinkID.
9002 Connection is down. ERROR Status of the interface has changed to 'down'. The interface is identified by the LinkID.
9003 300s-statistics is up. MESSAGE Sent when there was any traffic on the interface identified by the LinkID after a period without traffic. (Ceases a preceding '9004' event.)
9004 300s-statistics is down. ERROR Sent when there was no traffic in the last 300s period on the interface identified by the LinkID.

IP address names

 The IPAddrNames2.csv file contains the IP address names for the IP addresses and logical ports.

Each row contains the IP address or range, LogicalPort, EP/Node and DisplayName. This file can be seen in the web-interface, too.

Some example for IP address name list: 

		10.133.128.2,	*,	MSS0A,	MSS0A_a
		10.133.192.2,	1092,	MSS0A,	MSS0A_b
		145.236.52.1-145.236.52.3, 	*,	MSAN,	MSAN 
		145.236.55.0/26, 	*,	MSAN,	MSAN

Checking IP address names list

 The Check_IPAddrNames2 can check the integrity and consistency of the IP address names list. This is a command line utility with the list file to be checked as the input argument.

Usage of the utility: 

		Check_IPAddrNames2.exe IPAddrNames2.csv
It checks the input file whether it contains valid entries (follows the structure) and whether the IP addresses contains duplications or colliding ranges.
Warnings generated during the file checking can be suppressed for one or more ranges of the list by putting a comment line before the first entry of the range with a leading "-W". Warning suppression is switched off by putting a comment line after the last entry of the range with a leading "+W".

Example for warning suppression: 

		;-W Warnings possibly generated by entries below would be suppressed.
		10.133.128.2,	*,	MSS0A,	MSS0A_a
		10.133.192.2,	1092,	MSS0A,	MSS0A_b
		145.236.52.1-145.236.52.3, 	*,	MSAN,	MSAN 
		145.236.55.0/26, 	*,	MSAN,	MSAN 
		;+W Warning suppression is off.