captures.linux-pcap

linux_pcap

Adds a Linux packet source to a named capture. Capture starts when the configuration is loaded, independently of AAA processing, so it can include failed handshakes and rejected requests.

captures {
    capture "NETWORK" {
        linux_pcap {
            device "any";
            filter "udp port 1812 or tcp port 2083";
        }
        memory;
        file {
            directory "/var/lib/radiator/captures";
            filename "network.pcapng";
        }
    }
}

• device: interface name or "any" (default). Captures the server's network namespace.
• filter: required, nonempty libpcap BPF expression. Selects captured packets without changing firewall policy.
• snaplen: maximum captured bytes per packet, 1-65535; default 65535.
• capture-buffer-size: requested kernel buffer size in bytes, 1-2147483647; default 4194304.

A capture with this source requires at least one memory, file or log output. File output requires a fixed filename. PcapNG output preserves packet timestamps, link types and original lengths. HTTP API packet details show raw frame metadata and bytes; use Wireshark for network dissection. Raw frames have no AAA Context-Id.

Requirements and permissions

The server process needs effective CAP_NET_RAW. Full configuration checks (--test full) also need this capability: they briefly open the selected device to validate its BPF filter. For the packaged systemd service, a drop-in can extend its existing capabilities:

[Service]
AmbientCapabilities=CAP_NET_BIND_SERVICE CAP_NET_RAW

Containers must grant that capability to the server process in the network namespace being captured. A separate network namespace does not see host traffic. This capture source does not require CAP_NET_ADMIN.

TLS decryption

Set the TLS block's keylog_filename to "capture:NETWORK" to send that connection's session secrets to this capture. Include the handshake and secrets when downloading a capture for Wireshark decryption. Certificates alone do not decrypt modern TLS.

Performance impact

Packet capture has a noticeable performance impact. Even with a small kernel buffer, Radiator Server continuously reads and processes captured packets. Enable capture temporarily for troubleshooting; do not leave it enabled in production deployments.

Queue and buffer sizes

Each capture's application queue holds at most 1024 records, each at most 65535 bytes. Overload drops capture records without blocking authentication. Linux acquisition reads directly from its bounded kernel buffer. Memory output retains at most its configured record count and 64 MiB of record data, evicting oldest records including TLS secrets.

Capture statistics

GET /api/v1/captures/NETWORK/stats reports queue_dropped, kernel_dropped, interface_dropped, output_errors, source_failed and stopped. Counters reset when the capture definition is replaced. File errors count failed writes. Invalid frame metadata drops that frame; failed statistics reads retain the last sample. Both are logged and acquisition continues. Terminal source errors set source_failed and require a configuration reload to restart Linux acquisition. Application records and TLS secrets remain writable; stopped indicates that the entire capture worker has stopped.