Version 6: capture only metadata or packet header or snap Length BPF

[webking1]

Hi,

I am having trouble setting bpf filter "bpf=-s60" to capture only metadata or packet header or snap Length. I was able to do this in the past I believe with version 4? It's been awhile that I don't remember what the setting was but I was pretty sure I was able to use bpf filter to truncate the packet size to just the header. I've tried all sort of bpf= filter but it always return an error capture can't started when I restart the capture service.

Can someone tell me if this is still supported or how to capture just the packet header in version 6? Thanks.

[awick]

pcapWriteMethod=null might be what you are thinking of. https://arkime.com/settings#pcapWriteMethod. Arkime has never supported saving pcap with just the pcap headers or a certain snap length.

[webking1]

I probably have used this filter in the past such the one below.

bpf = len < 64

Because when I viewed the detail of the packet, it appears truncated. I think that was how I was able to reduce the size of the packet to save disk space. It took me a few days to recall what I did and it's working as I wanted. However, I also tried the method you mentioned and not sure if it was effective. I'll probably revisit it to try to observe what it looks like. I also read the notes that pcap files will automatically get deleted when disk is full or so and observed that the metadata remains which is very good as well. I've also tried to delete the pcap manually and restart the capture and it appears that the metadata has retained as well.

Thanks aWick!

[awick]

I probably have used this filter in the past such the one below.

bpf = len < 64

That will only let small packets thru, I doubt what you want, since Arkime won't see the packets that are useful. Remember the bpf is execute BEFORE arkime even sees the packets.

Because when I viewed the detail of the packet, it appears truncated. I think that was how I was able to reduce the size of the packet to save disk space. It took me a few days to recall what I did and it's working as I wanted.

They aren't truncated, just the small packets are delivered.

However, I also tried the method you mentioned and not sure if it was effective. I'll probably revisit it to try to observe what it looks like.

what do you mean?

I also read the notes that pcap files will automatically get deleted when disk is full or so and observed that the metadata remains which is very good as well. I've also tried to delete the pcap manually and restart the capture and it appears that the metadata has retained as well.

deleting them yourself is not recommended because that will leave the files index with incorrect data and when you open the pcaps it will log errors

[webking1]

I think this is what I am looking for and you mentioned it. I tried and it worked. Thank you so much!

pcapWriteMethod=null