5.5.13. Managing capture interface aggregation
5.5.13.1. Introduction
This procedure describes the aggregation of capture interfaces.
For more information on aggregation, see the paragraph Capture and monitoring interfaces monx
between TAP and GCap: aggregation possibility.
The aggregation functionality of the capture interfaces on the GCap leads to impacting some related functions:
Maximum Transmission Unit (MTU): the maximum size of a packet that can be transmitted at one time without fragmentation.
MTU: uses the largest value of the interfaces making up the aggregation.Static rules for filtering flows captured by capture interface: XDP (eXpress Data Path) filter function.
XDP filtering is not applied by default to the aggregation created but rather to the interfaces that comprise it.
It must therefore be applied individually to each aggregated interface.File rebuilding rules.
Rebuild rule: When enabling interface aggregation and multi-tenant detection, file rebuild rules are not generated.
To create an aggregation of two interfaces, use the set interfaces assign-role command.
5.5.13.2. Prerequisites
User: setup
Commands used in this procedure:
5.5.13.3. Preliminary operations
Connect to the GCap (see Procedure for connecting to the GCap via SSH).
Stop the detection engine (see monitoring-engine).
5.5.13.4. Procedure for displaying the aggregation of capture interfaces
Enter the
show interfaces
command then validate.
The system displays the information of all network interfaces.
A specific role is available for cluster : capture-cluster
.
In our example, we don't see this role, so there is no cluster.
5.5.13.5. Procedure to create an interface aggregation
In our case, we are going to create a cluster with
enp4s0
andenp12s0
.Enter the following commands.
(gcap-cli) set interfaces assign-role enp4s0 capture-cluster (gcap-cli) set interfaces assign-role enp12s0 capture-cluster
Validate.
5.5.13.6. Procedure for displaying the created aggregation
Enter the following command.
(gcap-cli) show interfaces
Validate.
The system displays the following information:
In this example,
enp4s0
andenp27s0
are now aggregated with the rolecapture-cluster
incluster0
.