Recordings

This page lists all recordings made by the groups that the current user belongs to. The admin user can see all recordings. All the important information is present - the recording ID, current state of the recording, its start and end, and the result of the analysis. The page also shows action buttons and tools needed to manipulate recordings and their data.

The recordings can be filtered by date and time, recording ID, state, and recording rule. You can enter a recording rule into the Filtering rule field. Any input with digits (for example, IP address, MAC address, or VLAN ID) is compared to the actual recording rules in a numerical manner. Any input containing characters (for example, SIP URI) is processed using a substring search.

The Action column allows you to:

• Start a waiting recording
• Stop an active one
• Start the analysis of finished recordings (for more details, refer to the following section: Analysis)
• View additional details about the recording (for example, description or filtering rule)
• Change the end time of unfinished recordings
• Download the recordings
• Delete a whole recording or only its data

In the Analysis Result column, you can view the result of the analysis.

Recordings can be in one of the following states:

• Waiting - the recording has not started yet; it can be started manually.

• Active - the recording is in progress; it can be stopped.

• Recorded - the recording or uploading has finished.

• Aborted - a user has stopped the recording.

• Waiting to analyze - the analysis of this recording is queued.

• Analyzing - packet analysis is in progress.

• Analyzed - the analysis has finished.

• Analysis failed - a problem has occurred during the analysis.

Download Recording

Clicking Download displays a dialog to download the recording. By enabling the Select particular files option in the popup dialog, you can select which PCAP files you want to download. The files of the recording are then automatically packaged in a zip archive. The download starts after clicking Download Files.

Data from all probes are either stored in one file for the given time period or split per interface. Each file contains data collected during a set time interval (typically 5 minutes) which is needed to prevent files that are too large. The timestamp included in the filename indicates when the file was created and which data (time-wise) it contains.

Delete Recording

To delete a whole recording or only its data, click Delete for that recording in the Action column. By enabling the Select particular files option in the popup dialog, you can select which PCAP files to delete. Clicking Delete Files deletes only the data (either all files or the files you have selected), while Delete Recording and Files deletes the whole recording.

This operation cannot be reverted so ensure you are deleting the correct data. Deleting a recording or some of its PCAP files may take a long time depending on the volume of data being deleted and the current load on the system. If you close the popup dialog, the process continues in the background and the content of the page will be updated when the process has been successfully completed.