Managing Packet Capture Task

The ATIC Management center provides the packet capture function by delivering packet capture tasks such as the ACL-based, global, attack event-based, and anomaly-based packet capture tasks to AntiDDoS. According to the packet capture tasks, anti-DDoS devices capture packets, generate packet capture files, and save the files to the anti-DDoS collector for future analysis.

Choose Defense > Policy Settings > Packet Capture, and manage packet capture tasks:

Create	Click to create a packet capture task in the ATIC Management center. For details, see Creating an ACL Matched Packet Capture Task, Creating a Global Defense Packet Capture Task, Creating a Zone Attacked Packet Capture Task and Creating an Anomaly-based Packet Capture Task.
Enable	Select the check box of the packet capture task to be enabled and click . The system delivers commands to the AntiDDoS to implement the packet capture task. NOTE: If the packet capture type is Zone Attack Matched or Zone Anomaly Matched, the packet capture task can be enabled only after policies are successfully deployed on the Zone of the task.
Disable	Select the check box of the packet capture task to be disabled and click . The ATIC Management center delivers commands to the AntiDDoS to cancel the packet capture task.
Delete	Delete one packet capture task: Click in the Operation column to delete the corresponding packet capture task. Delete tasks in batches: Select the check boxes of multiple packet capture tasks and click above the list to delete the selected tasks. Select the check box on the title bar and click above the list to delete all the displayed packet capture tasks.
View	Click the name of the packet capture task to be viewed for details on the task. Click Close to close the dialog box.
Search	Basic search In the basic search area, select Device and State as search conditions, and then click . Advanced search Click Advanced Search. In the advanced search area that is displayed, set search conditions such as Device, State, Zone, Type or Task Name, and then click Search.

• Creating an ACL Matched Packet Capture Task
  An ACL-based packet capture task captures packets that pass through the AntiDDoS and match an ACL. Generally, ACL-based packet capture is applied to capturing packet traffic when no attack is launched. In this way, it extracts the features of normal traffic and employs them as comparison conditions. Alternatively, when packet loss or access failure occurs due to defense failure such as no attack detecting, you are advised to adopt the ACL-based packet capture to determine the type of attack packets for analyzing defense failures. After a packet capture operation is complete, the ACL packet capture becomes in Disable state. Enable this task upon the next packet capture operation.
• Creating a Global Defense Packet Capture Task
  A global defense packet capture task captures discarded packets, including those discarded by non-anti-DDoS policies such as malformed packet check and packet filtering. In so doing, causes for service interruption are exploited. After a packet capture operation is complete, the global discarding packet capture becomes in Disable state. Enable this task upon the next packet capture operation.
• Creating a Zone Attacked Packet Capture Task
  A Zone attack packet capture task captures packets discarded when the Zone is attacked for analyzing attack events. The packet capture counting of the task is based on the attack type. After a packet capture operation is complete, the packet capture task is in Enable state. Packets are captured upon the next attack.
• Creating an Anomaly-based Packet Capture Task
  An anomaly-based packet capture task captures anomaly packets of various types for analyzing anomalies. The packet capture counting of the task is based on the anomaly type. After a packet capture operation is complete, the packet capture task is in Enable state. Packets are captured upon the next anomaly.