¶ Introduction
This document explains how to expand the packet storage capacity on a Wyebot sensor by using an external USB drive. Wyebot sensors continuously capture packets on all 3 radio interfaces and store them locally. These packets can be retrieved by a user from the Wyebot cloud dashboard to be examined in Wireshark or other similar packet viewing programs. A ring buffer is used for local storage on the sensor - the oldest packets are overwritten with newer packets as the storage fills. In a typical wireless environment, the sensor is able to store packets for 1-2 days before they are overwritten. In busy environments with a lot of wireless traffic, a sensor may only be able to store a few hours worth of packets. To increase the storage capacity of a sensor, a USB storage drive can be used.
¶ Feature Requirements
The USB PCAP option is a licensed feature. You must first contact sales@wyebot.com to add this feature to your Wyebot subscription. Once activated, Wyebot will send you USB storage drives for each licensed sensor. These drives have been carefully selected to support the required write speeds, are high endurance, and specially formatted for use by this feature. These are the only drives that can be used for this feature - generic drives are not supported.
The sensor MUST be powered by an 802.3at PoE port or a DC adapter to use the USB PCAP feature. If the sensor detects only 802.3af power, the USB port will be disabled.
¶ Enable the Feature
Once this option has been added to your subscription plan and you have the USB drives, this feature must be enabled on the Wyebot cloud dashboard. On the Management → General tab, set the USB option to PCAP USB Storage and click Apply. This will enable the feature globally on all sensors. You can optionally change the size of the data packets saved. By default, sensors limit Data frames to 128 bytes, which allows for longer storage duration at the expense of truncated packets. Management and Control frames are saved in their entirety.
¶ Install the USB Drive
Power off the sensor and insert the USB drive into the port. Power the sensor back on. Once the sensor has connected back to the cloud, the USB drive status can be viewed on the Sensor Config → Info page. When packets are successfully being stored on the USB drive, the USB Status field will show Storage in use.
¶ Downloading PCAP Files
PCAP files can be downloaded using the Advanced → Trace Download page on the Wyebot dashboard. The requested PCAP files are transferred from the sensor to the cloud and are then downloaded to your computer. The PCAP files cannot be read directly from the USB drive by removing the drive from the sensor and inserting it in a laptop.