Highlighted
Absent Member.. Absent Member..
Absent Member..
728 views

RUM Probe 9.23. Reading data from PCAP file

Jump to solution

Dear All,

I'm tryng to get a RUM probe to parse a pcap file.

 

I've added this sintax to capture.conf but I'm getting no traffic at all.

 

[collector]
device
file /tmp/Traffico.pcap

 

Have you got any idea? What's is wrong with my setup?

 

Thank you, best regards,

                        Paolo

Labels (1)
0 Likes
1 Solution

Accepted Solutions
Highlighted
Micro Focus Expert
Micro Focus Expert

Hi Paolo,

 

the correct syntax is

 

[collector]

device pcap /tmp/Traffico_CheBanca.pcap

 

("pcap" instead of "file")

 

Please note that running the probe to read a PCAP file is NOT documented officially and not supported (which means it most likely will work, but if this doesn't work, R&D wouldn't be able to help to get it working). Depending on the RUM probe version you might get errors like the ones below in capture.log, you can ignore them

..

2013-06-10 13:39:22 [2340] INFO  collector <..\..\collector\MasterConfig.cpp:2603> - Configuration was successfully updated

2013-06-10 13:39:22 [2496] WARN  common <..\..\..\collector\common\ProbeSystemInfo.cpp:679> - Device pcap c:\LDAP_template.pcap ignored. Device name doesn't contain class ID ({hex num}.

..

 

Hope this helps and works!

 

Greetings

Siggi

Customer Support
Micro Focus

If you find that this or any post resolves your issue, please be sure to mark it as an accepted solution.

View solution in original post

1 Reply
Highlighted
Micro Focus Expert
Micro Focus Expert

Hi Paolo,

 

the correct syntax is

 

[collector]

device pcap /tmp/Traffico_CheBanca.pcap

 

("pcap" instead of "file")

 

Please note that running the probe to read a PCAP file is NOT documented officially and not supported (which means it most likely will work, but if this doesn't work, R&D wouldn't be able to help to get it working). Depending on the RUM probe version you might get errors like the ones below in capture.log, you can ignore them

..

2013-06-10 13:39:22 [2340] INFO  collector <..\..\collector\MasterConfig.cpp:2603> - Configuration was successfully updated

2013-06-10 13:39:22 [2496] WARN  common <..\..\..\collector\common\ProbeSystemInfo.cpp:679> - Device pcap c:\LDAP_template.pcap ignored. Device name doesn't contain class ID ({hex num}.

..

 

Hope this helps and works!

 

Greetings

Siggi

Customer Support
Micro Focus

If you find that this or any post resolves your issue, please be sure to mark it as an accepted solution.

View solution in original post

The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.