Skip to content
  • There are no suggestions because the search field is empty.

Configure Capture Settings

Configure Capture SettingsConfigure Capture Settings

When initially setting up the Decoder, configuring the network adapter interface is required. Additional optional capture settings are available; two that are frequently used are the Berkeley Packet Filter, and Capture Autostart.

netwitness_deccfgwf-cfgcapstg.png

Besides the basic network adapter interface setup, you may decide to use one of the special-purpose configurations described in (Optional) Preserve VLAN Tags When Using the Packet MMAP Capture Interface or (Optional) Configure a Decoder to Capture Data Across All Types of Network Interfaces

The rest of the capture settings have default values chosen to be effective in most cases (see a detailed list in Services Config View - General Tab). You can adjust these in some circumstances, for example, if Customer Support advises a change. You can edit the capture settings at any time.

Select a Network AdapterSelect a Network Adapter

The table below describes the Network Adapter settings for a Decoder. The system administrator sets the default network adapters when the Decoder is installed. Consult your System Administrator for more information.

To configure the network adapter on a Decoder:

  1. Go to netwitness_adminicon_25x22.png (Admin) > Services.

  2. In the Administration Services view, select the Decoder and netwitness_ic-actns.png​ > View > Config.

    The Services Config view is displayed with the General tab open.

    netwitness_deccon16.png

  3. In the Capture Interface Selected field, select the network adapter that best suits the Decoder.
  4. To save the changes, click Apply.
  5. If necessary to put the changes into effect, navigate back up to the Administration Services view, select the Decoder, and select netwitness_ic-actns.png > Restart.

Configure a Decoder to Begin Capturing Data AutomaticallyConfigure a Decoder to Begin Capturing Data Automatically

  1. Go to netwitness_adminicon_25x22.png (Admin) > Services.

  2. In the Administration Services view, select the Decoder and netwitness_ic-actns.png​ > View > Config.

    The Services Config view is displayed with the General tab open.

    netwitness_deccon16.png

  3. Under Capture Settings, select the Capture Autostart checkbox.
  4. To save the changes, click Apply.
  5. If necessary to put the changes into effect, navigate back up to the Administration Services view, select the Decoder, and select netwitness_ic-actns.png > Restart.

Configure Optional Capture SettingsConfigure Optional Capture Settings

  1. Go to netwitness_adminicon_25x22.png (Admin) > Services.

  2. In the Administration Services view, select the Decoder and netwitness_ic-actns.png​ > View > Config.

    The Services Config view is displayed with the General tab open.

    netwitness_decconf16.png

  3. If you want to apply a system-level filter to the packet stream before the packets are copied to the Decoder adapter for analysis, configure the Berkeley Packet Filter as described in (Optional) Configure System-Level (BPF) Packet Filtering.
  4. In the Capture Settings sections, review the default values. When a service is first added, default values are in effect and should be changed only in special circumstances, for example, if Customer Support advises a change. See Services Config View - General Tab for an explanation of these settings.
  5. In the Database Max File Sizes section, review the default values. When a service is first added, default values are in effect and should be changed only in special circumstances, for example, if Customer Support advises a change. See Services Config View - General Tab for an explanation of these settings.
  6. In the Hash section, define a directory for hash files if you are using this feature. See Services Config View - General Tab for an explanation of these settings.