2.1. recording_utils API

Extraction params:
  • time_from: epoch
  • time_to: epoch
  • filter: nBPF filter
Recording configuration params:
  • buffer_size: Buffer size (MB)
  • max_file_size: Max file length (MB)
  • max_file_duration: Max file duration (sec)
  • max_disk_space: Max disk space (MB)
  • snaplen: Capture length
  • writer_core: Writer thread affinity
  • reader_core: Reader thread affinity
  • indexer_cores: Indexer threads affinity
  • zmq_endpoint: ZMQ endpoint (optional)

Functions

function isSupportedZMQInterface(ifid)

Check if an interface is a ZMQ interface that can be used with external interfaces for traffic recording and flow import.

Return
true if supported, false otherwise
Parameters
  • ifid: the interface identifier

function getZMQProbeAddr(ifid)

Return the ZMQ endpoint that should be used by an external process (n2disk) to deliver flows to ntopng.

Return
the endpoint
Parameters
  • ifid: the interface identifier

function isSupportedInterface(ifid)

Check if an interface is supported for recording (packet interface, or ZMQ interface that can be used with external interfaces for traffic dump and flow import)

Return
true if supported, false otherwise
Parameters
  • ifid: the interface identifier

function isAvailable()

Check if traffic recording is available and allowed for the current user on an interface.

Return
true if recording is available, false otherwise

function getN2diskInfo()

Return information about the recording service (n2disk) including systemid and version.

Return
a table with the information

function setLicense(key)

Install a license for n2disk.

Return
true if the license is installed, false in case it is not possible
Parameters
  • key: The license key

function getExtInterfaces(ifid)

Return external interfaces, not in use by ntopng, that can be used through ZMQ interface for traffic recording and flow import.

Return
a table with external interfaces information
Parameters
  • ifid: the interface identifier

function getPcapPath(ifid)

Return the root path for recorded pcap data.

Return
the path
Parameters
  • ifid: the interface identifier

function storageInfo(ifid)

Read information about the storage, including storage size and available space.

Return
a table containing storage information (size is in bytes)
Parameters
  • ifid: the interface identifier

function createConfig(ifid, params)

Generate a configuration for the traffic recording service (n2disk)

Parameters
  • ifid: the interface identifier
  • params: the traffic recording settings

function isEnabled(ifid)

Check if traffic recording is available and enabled on an interface.

Return
true if recording is enabled, false otherwise
Parameters
  • ifid: the interface identifier

function isActive(ifid)

Check if the traffic recording service is running.

Return
true if the service is running, false otherwise
Parameters
  • ifid: the interface identifier

function restart(ifid)

Start (or restart) the traffic recording service.

Parameters
  • ifid: the interface identifier

function stop(ifid)

Stop the traffic recording service.

Parameters
  • ifid: the interface identifier

function log(ifid, rows)

Return the log trace of the traffic recording service (n2disk)

Return
the log trace
Parameters
  • ifid: the interface identifier
  • rows: the number of lines to return

function stats(ifid)

Return statistics from the traffic recording service (n2disk)

Return
the statistics
Parameters
  • ifid: the interface identifier

function isDataAvailable(ifid, epoch_begin, epoch_end)

Check if there is pcap data for a specified time interval (fully included in the dump window)

Return
a table with ‘available’ = true if the specified interval is included in the dump window, ‘epoch_begin’/’epoch_end’ are also returned with the actual available window.
Parameters
  • ifid: the interface identifier
  • epoch_begin: the begin time (epoch)
  • epoch_end: the end time (epoch)

function getJobFiles(id)

Return the list of pcap files extracted for a job.

Return
the list of pcap files (paths)
Parameters
  • job_id: the job identifier

function deleteJob(job_id)

Delete an extraction job and its pcap data on disk, if any.

Parameters
  • job_id: the job identifier

function deleteAndStopAllJobs(ifid)

Delete and stop all the extraction jobs for the specified interface.

Parameters
  • ifid: the interface identifier

function extractionJobsInfo(ifid)

Return statistics about the extraction jobs.

Return
the jobs statistics (ready, total)
Parameters
  • ifid: the interface identifier

function getExtractionJobs(ifid)

Return the list of scheduled extraction jobs.

Return
the list of jobs
Parameters
  • ifid: the interface identifier

function stopJob(job_id)

Stop a running extraction job.

Parameters
  • job_id: the job identifier

function scheduleExtraction(ifid, params)

Schedule a new extraction job.

Return
the newly created job
Parameters
  • ifid: the interface identifier
  • params: the extraction parameters. time_from/time_to (epoch) are mandatory. filter (nBPF format) is optional.