Use tcpServer to specify endpoints

Stream forwarder automatically detects the client and server endpoints when it captures the beginnings of TCP connections. If it starts capturing traffic after establishing a TCP connection, the Stream forwarder assumes that the sender of the first packet it sees is the client.

You can modify this behavior by editing the tcpServer parameter to define the endpoints of specific TCP servers. If the sender for a packet matches the endpoint, Stream forwarder correctly categorizes it as a server response packet.

Example: Define a Single HTTP server endpoint using tcpServer

tcpServer.N.address = 192.168.1.102
tcpServer.N.port = 80

Example: Define a Wildcard endpoint using tcpServer

tcpServer.<N>.address = 192.168.1.0
tcpServer.<N>.addressWildCard = 255.255.255.0
tcpServer.<N>.port = 80

Use the sslServer parameter to specify encrypted/decrypted traffic

Stream forwarder detects endpoint encryption and attempts to decrypt SSL sessions using the available private keys. You can optionally define the traffic as encrypted by adding sslServer parameters.

sslServer.<N>.address = 192.168.1.102
sslServer.<N>.port = 443

Use streamfwdcapture to specify network interfaces

By default, streamfwd.conf listens for traffic on all available network interfaces. Use the streamfwdcapture parameter to restrict data capture to specific interfaces.

The streamfwdcapture parameter supports the following options:

To restrict data capture to specific network interfaces, add a [streamfwd] stanza to streamfwd.conf. You can use streamfwdcatpure parameters to specify multiple network interfaces in a single streamfwd.conf file. For example, to specify two network interfaces - eth0 and eth1 - configured with different BPF filters on *nix:

[streamfwd]
streamfwdcapture.0.interface = eth0
streamfwdcapture.0.filter = tcp port 80
streamfwdcapture.1.interface = eth1
streamfwdcapture.1.filter = udp port 53

Specify a network interface on Windows

This example specifies a Windows network interface:

streamfwdcapture.0.interface = \Device\NPF_{D6995D00-B75C-48DB-99AA-69F0150126BC}
streamfwdcapture.0.offline = false
streamfwdcapture.0.filter = tcp port 80

On Windows, you can substitute the streamfwdcapture.<N>.interface or streamfwdcapture.<N>.InterfaceRegex name (such as \Device\NPF_{D6995D00-B75C-48DB-99AA-69F0150126BC}) with the <Alias> or <Description> value returned by the --iflist command line option.

For example, streamfwdcapture.<N>.interface = Local Area Connection 2 or streamfwdcapture.<N>.InterfaceRegex = Local Area.*.

For more information, see "List network interfaces on Windows and Linux" in this manual.

streamfwdcaptureexamplesstreamfwdcapture examples

Example: Configure streamfwd.conf to include local loopback capture

Stream forwarder by default does not capture traffic that originates and terminates on the same machine. You can enable capture of this "local loopback" traffic using the streamfwdcapture parameter in the configuration file:

   streamfwdcapture.<N>.interface = lo0

Note: you cannot use streamfwdcapture.<N>.interfaceRegex> parameter to specify local loopback interfaces.

Example: Configure streamfwd.conf for use across multiple systems

As a best practice, maintain a master copy of streamfwd.conf that you can reuse across multiple systems that have different network device names. The following streamfwd.conf configuration listens on all matching interfaces found. This configuration does not capture local loopback interfaces.

streamfwdcapture.<N>.interfaceRegex = .*

Note that this configuration may generate startup warnings for any devices that do not support passive data capture.

Example: Capture data on specific network interfaces

In this example, on a system with eight network interfaces, streamfwd.conf would listen only for tcp port 80 traffic on only two of those interfaces (four and five):

streamfwdcapture.<N>.interfaceRegex = eth[45]
streamfwdcapture.<N>.offline = false
streamfwdcapture.<N>.filter = tcp port 80

Example: Add streamfwdcapture parameters to streamfwd.conf configuration file

You can add one or more streamfwdcapture parameters to a [streamfwd] stanza to define capture behavior for a particular network interface.

[streamfwd]
streamfwdcapture.0.interfaceRegex = eth[45]
streamfwdcapture.0.offline = false
streamfwdcapture.0.filter = tcp port 80
streamfwdcapture.1.interface = eth0
streamfwdcapture.1.offline = false
streamfwdcapture.1.filter = udp port 53