Downloading traffic when working with the network interaction map

When working with the network interactions map, you can download traffic received by the application via the monitoring points. The traffic is downloaded to a PCAP file. You can configure network packet filtering to download the relevant data.

The application downloads traffic from the traffic dump file storages. Both the internal storage of each node (created automatically when an application component is installed on the node) and the external storage, if connected on the node, can be used to download traffic.

When downloading traffic, take the following considerations into account:

• Traffic dump files are temporarily stored in the storages and are automatically deleted as new traffic is received. The frequency of file deletion depends on the amount of traffic received and on the specified application data storage settings. The traffic cannot be downloaded if the corresponding traffic dump files are deleted from the repositories.
• Only the users with the Administrator role can download traffic when working with the network interactions map.

To download traffic when working with the network interactions map:

1. Connect to the Kaspersky Industrial CyberSecurity for Networks Server through the web interface using the Administrator account.
2. On the Network interactions map tab in the Network map section, click the Download traffic button.

   The details area appears in the right part of the web interface window.

3. Perform the following actions:
   • To download traffic for a certain period of time, define the desired boundaries using the Period of traffic to download setting.

     By default, the period is set to the period configured for filtering specified on the time scale.

   • Set a limit on the maximum volume used for the downloaded traffic in the Download volume limit section.

     If the volume of the downloaded traffic exceeds the specified limit, the traffic that arrives later is skipped.

   • If necessary, enable filtering in the Filtering by monitoring points section and specify the monitoring points that received the desired traffic.

     By default, all monitoring points available on nodes with the installed application components are specified.

   • If necessary, enable filtering in the Filtering by address spaces section and specify the address spaces to which the addresses in the network packets belong (this section is displayed if additional address spaces are added to the application).

     By default, all address spaces created in the application are specified.

   • If necessary, enable filtering in the BPF filtering section and enter a filtering expression using the Berkeley Packet Filter (BPF) technology based on the address settings of the network packets.

     Filtering expression example:
     tcp port 102 or tcp port 502

   • If necessary, enable filtering in the Filtering using regular expressions section and enter an expression for filtering based on payload data in network packets.

     Filtering expression example:
     ^ test. + xABxCD

4. Click the Show button.
5. If it takes a long time (more than 15 seconds) to create the file, the file creation operation is transferred to the list of background operations. In this case, to download the file:
   1. Click the button in the menu of the application web interface.

      The list of background operations appears.

   2. Wait for the file creation operation to finish.
   3. Click the Download file button.

Your browser will save the downloaded file. Depending on your browser settings, your screen may show a window in which you can change the path and name of the saved file.