Calnex SNE: Why do I sometimes see 24-byte PCAP files listed from the REST API?

Owned by Paul Hudson
Last updated: Jun 20, 2022
2 min read

This article relates to SNE versions up to and including version 7.x. It does not apply to the Web UI (web browser-based user interface).

In SNE firmware v7.0, you may occasionally see very small (24-byte) PCAP files listed while maps are running that contain Traffic Capture TAPs. In v7.0 the REST API behaves as follows:

  • For every disabled Traffic Capture tap (and enabled Traffic Capture taps if no traffic is flowing), a small (24-byte) file will be created and will be listed if you do GET /api/files/capturereplay

  • Under these same conditions, if you open the Captured traffic files window in the GUI client software, you will see a file listed for each traffic capture, with 'Used File Size: 0.00 MB (0.0% used)':

  • These 24-byte files are the PCAP header. They will be present only when the map is running, and cannot be deleted while the map is running. When you stop the map, those temporary 24-byte files will be "cleaned up" (automatically deleted).

  • When you enable the (previously disabled) Traffic Capture taps, those 24-byte files will grow in size as the capture fills up, and the resulting files will remain after the map is stopped (they will NOT be automatically deleted).

  • If you need to delete any PCAP files, this should be done while the map is stopped. Ideally it would be done without any maps loaded (so before you upload the map, or after you unload it) but this isn't strictly necessary, just "best practise".