8.14. Procedure to manage capture interface aggregation

A - Introduction

This procedure describes the capture interface aggregation.

For more information on aggregation, refer to paragraph Monx capture interfaces between TAP and GCap: possibility of aggregation.

The aggregation functionality of the capture interfaces on the GCap leads to impacting some related functions:

• Maximum Transmission Unit (MTU): the maximum size of a packet that can be transmitted at one time without fragmentation.

  set advanced-configuration mtu : takes the largest value of the interfaces that make up the aggregation.
• Static rules for filtering flows captured by capture interface: XDP (eXpress Data Path) filter function.

  XDP filtering is not applied by default to the aggregation created but rather to the interfaces that comprise it.

  It must therefore be applied individually to each aggregated interface.
• File rebuilding rules Rebuild rule<http://file_capability.html#capacité-de-reconstruction-de-fichiers> : When enabling interface aggregation and multi-tenant detection, file rebuild rules are not generated.

For...	Use the command	carry out the procedures successively
Display the interfaces aggregation of capture	show interfaces	1 - C - Preliminary operations 2 - D - Procedure to manage capture interface aggregation
Create an interface aggregation	set network-config	1 - C - Preliminary operations 2 - E - Procedure to create an interface aggregation
Display the created aggregation status	show interfaces	1 - C - Preliminary operations 2 - F - Procedure to display the created aggregation status

---

B - Prerequisites

• User: setup

• Commands used in this procedure:

  • show interfaces

  • set network-config

---

C - Preliminary operations

1. Connect to the GCap (refer to Procedure to remote connection to GCap via an SSH tunnel)

2. Stop the Sigflow detection engine (refer to monitoring-engine)

---

D - Procedure to manage capture interface aggregation

The command prompt is displayed.

(gcap-cli)

1. Enter the command

   show interfaces
   

2. Validate

   The system displays the information of all network interfaces

   

   A specific role is available for cluster: `capture-cluster`

   In our example, we don't see this role, so there is no cluster

---

E - Procedure to create an interface aggregation

In our case, we are going to create a cluster with `enp4s0` and `enp12s0`.

The command prompt is displayed.

(gcap-cli)

1. Enter the command

   set interfaces assign-role enp4s0 capture-cluster
   set interfaces assign-role enp12s0 capture-cluster
   

2. Validate

---

F - Procedure to display the created aggregation status

The command prompt is displayed.

(gcap-cli)

1. Enter the command

   show interfaces
   

2. Validate

   The system displays the created aggregation

   

   In this example, `enp4s0` and `enp27s0` are now aggregated with the role `capture-cluster` in `cluster0`.

---