Targeted PDU capture by a network device for enhanced wireless network diagnostics
A network device with wireless access point capabilities selectively captures PDUs detected on an instrumented interface(s) to capture those of one or more types/subtypes “of interest.” PDU types/subtypes that network device interface(s) has been instrumented to treat as “of interest” include those transmitted during a device's initial network activity during startup or attempted establishment of a wireless network connection. The interface(s) instrumented for targeted PDU capture can include wireless and/or wired (e.g., Ethernet) interfaces that are received on raw sockets so that each header type of a captured PDU is written to the PDU capture file. Prior to upload of a PDU capture file to a system from which it can be retrieved for analysis, the network device adds network metadata to the file based on context of the environment in which the network device operates. The network metadata can include IP address and/or network topology information determined at runtime.
1 . A method comprising:
receiving a first protocol data unit (PDU) on a first interface of a plurality of interfaces of a network device, wherein the first interface is one of the plurality of interfaces of the network device instrumented to capture PDUs, wherein the network device comprises a wireless access point;
determining a type of the first PDU, wherein the type of the first PDU corresponds to a communication protocol with which the first PDU is associated;
determining if the first PDU should be captured based on a type of the first PDU and a type of the first interface on which the first PDU was received;
based on determining that the first PDU should be captured, writing a copy of the first PDU in a PDU capture file;
associating information about a network environment in which the network device operates with the PDU capture file as metadata; and
based on determining that an upload criterion has been satisfied, uploading the PDU capture file having the metadata associated therewith to a server.
2 . The method of claim 1 further comprising instrumenting the plurality of interfaces to capture PDUs based on, for each interface of the plurality of interfaces, declaring a raw socket and binding the raw socket to the interface.
3 . The method of claim 2 , wherein receiving the first PDU on the first interface comprises receiving the first PDU on the raw socket bound to the first interface.
4 . The method of claim 1 further comprising determining the information about the network environment in which the network device operates based on at least one of a neighbor table, a topology table, and a Dynamic Host Configuration Protocol (DHCP) table that the network device maintains.
5 . The method of claim 1 , wherein the plurality of interfaces comprises at least one of an Ethernet interface, a wireless interface, a bridge interface, and a loopback interface of the network device.
6 . The method of claim 1 , wherein determining that an upload criterion has been satisfied comprises at least one of determining that the PDU capture file has reached a size threshold, determining that PDU capture has been ongoing for a time that exceeds a time threshold, or determining that the PDU capture file should be uploaded in accordance with a schedule.
7 . The method of claim 1 , wherein determining the type of the first PDU further comprises determining a subtype of the first PDU, and wherein determining if the first PDU should be captured based on the type of the first PDU further comprises determining if the first PDU should be captured based on the subtype of the first PDU.
8 . The method of claim 1 , wherein determining if the first PDU should be captured based on the type of the first PDU comprises determining if the first PDU is an 802.11 management frame, a DHCP message, a 4-way handshake message, or an Address Resolution Protocol (ARP) message.
9 . The method of claim 1 , wherein the PDU capture file is a Packet Capture (PCAP) file or a PCAP Next Generation (PCAPNG) file.
10 . The method of claim 1 further comprising:
receiving a second PDU on the first interface of the network device;
determining that the second PDU should not be captured based on a type of the second PDU; and
allowing the second PDU to pass without writing a copy of the second PDU to the PDU capture file.
11 . The method of claim 1 , wherein the receiving, determining, and writing are triggered based on receipt of a request that indicates the network device, and wherein the receiving, determining, and writing are performed for a first length of time after receipt of the request.
12 . The method of claim 11 , wherein determining that the upload criterion has been satisfied comprises determining that the first length of time has elapsed.
13 . One or more non-transitory computer-readable media comprising program code for a network device comprising a wireless access point to selectively capture protocol data units (PDUs), the program code comprising instructions executable by a processor to:
instrument a plurality of interfaces of the network device to capture PDUs;
for each PDU of a plurality of PDUs received on one of the plurality of interfaces,
determine a type of the PDU, wherein the type of the PDU corresponds to a communication protocol with which the PDU is associated;
determine whether to capture the PDU based on the type of the PDU and a type of the one of the plurality of interfaces on which the PDU was received;
based on a determination that the PDU should be captured, capture the PDU in a PDU capture file;
add information about other devices with network interfaces in a same network environment as the network device to the PDU capture file as metadata; and
upload the PDU capture file to a server, wherein the PDU capture file that is uploaded comprises copies of a subset of the plurality of PDUs and the metadata.
14 . The non-transitory computer-readable media of claim 13 , wherein the instructions to determine whether to capture the PDU comprise instructions to determine whether the type is one of a plurality of PDU types designated for capturing for the one of the plurality of interfaces.
15 . The non-transitory computer-readable media of claim 14 , wherein the instructions to determine the type of the PDU comprise instructions to determine at least one of the communication protocol with which the PDU is associated and a type of the PDU indicated in a header of the PDU, wherein the header is formatted according to the communication protocol with which the PDU is associated.
16 . The non-transitory computer-readable media of claim 13 , wherein the instructions to instrument the plurality of interfaces comprise instructions to, for each interface of the plurality of interfaces, declare a raw socket and bind the raw socket to the interface.
17 . The non-transitory computer-readable media of claim 13 wherein the program code further comprises instructions to determine the information about other devices with network interfaces based on at least one of a neighbor table, a topology table, and a Dynamic Host Configuration Protocol (DHCP) table maintained by the network device.
18 . The non-transitory computer-readable media of claim 13 , wherein selectively capturing PDUs is triggered based on receipt of a request that indicates the network device, and wherein the instructions to upload the PDU capture file comprise instructions to upload the PDU capture file based on a determination that a first length of time since commencement of selectively capturing PDUs has elapsed.
19 . A network device comprising:
a wireless access point;
a processor; and
a computer-readable medium having instructions stored thereon that are executable by the processor to cause the network device to,
for each interface of a plurality of interfaces of the network device that is instrumented to capture protocol data units (PDUs),
based on receipt of a PDU on the interface, determine a type of the PDU, wherein the type of the PDU corresponds to a communication protocol with which the PDU is associated;
determine if the type of the PDU is designated for capturing for the interface on which the PDU was received; and
based on a determination that the type of the PDU is designated for capturing, capture the PDU in a first file;
associate information determined about a network environment in which the network device is located with the first file as metadata; and
upload the first file to a server based on satisfaction of an upload criterion.
20 . The network device of claim 19 , wherein the instructions executable by the processor to cause the network device to determine if the type of the PDU is designated for capturing comprise instructions executable by the processor to cause the network device to determine if the PDU is an 802.11 management frame, a Dynamic Host Configuration Protocol (DHCP) message, or an Address Resolution Protocol (ARP) message.
21 . The network device of claim 19 , wherein the instructions executable by the processor to cause the network device to capture the PDU in a first file comprise instructions executable by the processor to cause the network device to write a copy of the PDU to a Packet Capture (PCAP) file or a PCAP Next Generation (PCAPNG) file.
22 . The network device of claim 19 , wherein the plurality of interfaces comprise one or more of an Ethernet interface, a wireless interface, a bridge interface, and a loopback interface of the network device.
23 . The network device of claim 19 further comprising instructions executable by the processor to cause the network device to instrument each interface of the plurality of interfaces, wherein the instructions executable by the processor to cause the network device to instrument each interface comprise instructions executable by the processor to cause the network device to declare a raw socket and bind the raw socket to the interface.
24 . The network device of claim 19 further comprising instructions executable by the processor to cause the network device to determine that the upload criterion has been satisfied, wherein the instructions executable by the processor to cause the network device to determine that the upload criterion has been satisfied comprise instructions executable by the processor to cause the network device to determine that a first length of time since receipt of a request to capture PDUs in the first file has elapsed.