Flow captures can be started from the WebUI or thanks to the Skydive client. Skydive leverages the Gremlin language in order to select nodes on which a capture will be started. The Gremlin expression is continuously evaluated which means that it is possible to define a capture on nodes that do not exist yet. It useful when you want to start a capture on all OpenvSwitch whatever the number of Skydive agents you will start.
While starting the capture, you can specify the capture name, capture description and capture type optionally.
At this time, the following capture types are supported:
ovssflow, for interfaces managed by OpenvSwitch such as OVS bridges
afpacket, for interfaces suchs as Linux bridges, veth, devices, …
pcap, same as
dpdk, for interfaces managed by DPDK
pcapsocket. This capture type allows you to inject traffic from a PCAP file. See below for more information.
Node types that support captures are :
If the flow probe
pcapsocket is enabled, you can create captures with the
pcapsocket. Skydive will create a TCP socket where you can copy PCAP
nc for instance). Traffic injected into this socket will have
its capture point set to the selected node. The TCP socket address can be
retrieved using the
PCAPSocket attribute of the node or using the
PCAPSocket attribute of the capture.