Napatech

First Installation

Steps

• download latest Napatech drivers and untar it into e.g. /opt/napatech3
• build the driver
• download the the sniffer's source

cd /usr/src
git clone -b master https://github.com/voipmonitor/sniffer.git
   OR
git clone -b develop https://github.com/voipmonitor/sniffer.git
cd sniffer
./configure --with-dpdk-include=/opt/napatech3/include --with-dpdk-lib=/opt/napatech3/lib

Note: The development branch is named develop (NOT "development"). Use git checkout develop to switch to it.

If you already have the repository cloned and want to switch to the develop branch:

cd /usr/src/sniffer
git fetch origin
git checkout develop
git pull

Install all libraries that the configure needs.

• run make
• check it's built properly

root@server:/usr/src/sniffer# ldd ./voipmonitor | grep pcap
	libpcap.so.1 => /opt/napatech3/lib/libpcap.so.1 (0x00007fc0b69b0000)

• replace original binary in the /usr/local/sbin
• run it

Upgrade

The GUI way (from the sensor's version 24.23)

Until sensor's version 24.23 was not possible to do the sensor's upgrade via 'upgrade_by_git' option because the configure script overwritten the adjusted Makefile and you built a binary with standard pcap libs (until you overwritten the orig libs). With 'configure_param' option you can adjust the Makefile creation for appropriate includes/libs

• set these options into voipmonitor.conf

upgrade_by_git = yes
git_folder = /usr/src/sniffer
configure_param = --with-dpdk-include=/opt/napatech3/include --with-dpdk-lib=/opt/napatech3/lib

• restart sniffer
• do the upgrade via clicking in the GUI

The sniffer will perform (after click on UPGRADE in GUI) git pull,configure,make_clean,make, service voipmonitor stop, make install, service voipmonitor start.

The manual way

cd /usr/src/sniffer
git checkout develop
git pull
./configure --with-dpdk-include=/opt/napatech3/include --with-dpdk-lib=/opt/napatech3/lib
make

• copy to the original directory and restart sensor

napatech drivers

Settings sample

• in voipmonitor.conf

interface = napa0

# filter option must be commented out !!! E.g.
#filter = udp or (vlan and udp)

• /opt/napatech3/config/ntpcap.ini

# Napatech default ntpcap.ini file
[Common]
Ntpl1 = "Assign[streamid=0;txport=0;txignore=true]=all"

[napa0 ]
StreamId = 0
Tx = 0

• old version

[napa0]
Rx1="Assign[streamid=252;txport=0;txignore=true]=all"
Tx=0

• /opt/napatech3/config/ntservice.ini

[System]
TimestampFormat = NATIVE_UNIX
TimestampMethod = EOF
HostBufferWaitMethod = 0
SDRAMFillLevelWarning = 0

[logging]
LogMask = 0x07
LogToFile = 0
LogFileName = /tmp/Log3G_%s.log
LogBufferWrap = wrap

[Adapter0]
AdapterType = NT4E
BusId = 00:07:00:00
PacketDescriptor = NT
HostBuffersRx = [8,16,0]
HostBuffersTx = [8,16,0]
TimeSyncProtocol = NT
TimeSyncConnectorIn = Ext
TimeSyncConnectorOut = None
TimeSyncConnectorRepeat = None
TimeSyncTimeJumpThreshold = 1
TimeSyncTimeOffset = 0
MaxFrameSize = 9018
AltTPID = 0x8100
Profile = Capture
DiscardSize = 16
OsTimeSyncFailover = DISABLE

Timing source In napatech where timestamp of packets is shifted to GMT and you want use system time instead: GMT:

TimeSyncConnectorExt1 = PpsIn

System dependent:

TimeSyncConnectorExt1 = NttsIn

For new napatech drivers use following to set OS time for packets from napatech

TimesynConnectorExt1  = None
TimeSyncReferencePrioroity =OSTime

Troubleshooting: If spool directories are created with incorrect dates (e.g., 1970-01-01), see below for the solution by setting timeSource = OS.

Hints

service file for voipmonitor

You need to add to voipmonitor's service file that napatech drivers (ntservice) needs to be started before the voipmonitor by modifiyng the service file

Filter traffic on Napatech card

If you want to filter a data directly in the Napatech card you can use this example as a starting point. (many thanks to Distributel for the example)

Create a file e.g /opt/napatech3/myfilter.ntpl

# Start NTPL
# Delete all existing filter
delete = all

# Setup UDP macros

DefineMacro("mUdpSrcPort", "Data[DynOffset=DynOffUDPFrame;Offset=0;DataType=ByteStr2]")
DefineMacro("mUdpDestPort", "Data[DynOffset=DynOffUDPFrame;Offset=2;DataType=ByteStr2]")

# Setup filters
# The first line is the SIP filter. The second line is the RTP filter for our specific ports in HEX (10000-61743)

Assign[StreamId = 0] = (mUdpSrcPort == 5060, 5061) AND (mUdpDestPort == 5060, 5061)
Assign[StreamId = 0] = (mUdpSrcPort == (0x2710..0xF12F))
Assign[StreamId = 1] = (mUdpSrcPort == 5060, 5061) AND (mUdpDestPort == 5060, 5061)
Assign[StreamId = 1] = (mUdpSrcPort == (0x2710..0xF12F))
Assign[StreamId = 2] = (mUdpSrcPort == 5060, 5061) AND (mUdpDestPort == 5060, 5061)
Assign[StreamId = 2] = (mUdpSrcPort == (0x2710..0xF12F))
Assign[StreamId = 3] = (mUdpSrcPort == 5060, 5061) AND (mUdpDestPort == 5060, 5061)
Assign[StreamId = 3] = (mUdpSrcPort == (0x2710..0xF12F))
# End NTPL

# Enable Deduplication
DeduplicationConfig[drop=duplicate] = GroupID == 0
Define ckRecipe = CorrelationKey(Begin=StartOfFrame[0], End=EndOfFrame[0], DeduplicationGroupID=0)
Assign[StreamID=0,1,2,3; CorrelationKey=ckRecipe] = Port == 0,1,2,3

Start it with the command

/opt/napatech3/bin/ntstart.sh -n myfilters.ntpl

Troubleshooting: Spool Directories with Date 1970-01-01

If spool directories are created with incorrect timestamps (e.g., 1970-01-01 instead of the current date) on sensors using Napatech cards, this indicates the Napatech card is providing Unix Epoch time (timestamp = 0) instead of the actual system time.

Solution:

1. Edit the Napatech configuration file

Edit /opt/napatech/bin3/ntservice.ini (or /opt/napatech3/config/ntservice.ini on some installations).

2. Add or modify the timeSource settings

For newer Napatech drivers, add this parameter to force the card to use system time:

timeSource = OS

For older driver configurations in the [Adapter0] section, you may need to adjust:

OsTimeSyncFailover = ENABLE

3. Restart the Napatech service

systemctl stop ntservice
systemctl start ntservice

4. Restart the voipmonitor sniffer service

systemctl restart voipmonitor

5. Verify the fix

# Check that new directories have correct dates
ls -ltd /var/spool/voipmonitor/*

Troubleshooting: Napatech Interfaces in DOWN State

If standard capture tools like tcpdump or tshark show no packets on Napatech interfaces, verify that the Napatech interfaces are not in a DOWN state.

1. Check interface status

# Check if Napatech interfaces are UP
ip link show napa0

# Check all Napatech interfaces
ip link show | grep napa

If the interfaces show a DOWN state instead of UP, continue with step 2.

2. Verify Napatech drivers are loaded

# Check if ntpcap module is loaded
lsmod | grep ntpcap

# Check Napatech driver service status
systemctl status ntservice

If the drivers are not loaded, start the service:

systemctl start ntservice

3. Check if custom libpcap is being used

The Napatech setup requires linking against a custom libpcap library provided by Napatech. Standard system libpcap will not work correctly with Napatech cards.

# Verify voipmonitor is linked against Napatech libpcap
ldd /usr/local/sbin/voipmonitor | grep pcap

Expected output should show something like:

libpcap.so.1 => /opt/napatech3/lib/libpcap.so.1 (0x00007f00b69b0000)

If it shows system libpcap (e.g., /lib/x86_64-linux-gnu/libpcap.so.1), you need to rebuild using the custom library.

4. Rebuild with custom libpcap

If voipmonitor is not using the Napatech libpcap, rebuild the sniffer:

cd /usr/src/sniffer
git pull
./configure --with-dpdk-include=/opt/napatech3/include --with-dpdk-lib=/opt/napatech3/lib
make
make install
systemctl restart voipmonitor

After rebuilding, verify again with ldd /usr/local/sbin/voipmonitor | grep pcap.

5. Check ntpcap configuration

Incorrect ntpcap configuration can prevent interfaces from coming up properly. Review /opt/napatech3/config/ntpcap.ini:

cat /opt/napatech3/config/ntpcap.ini

Ensure:

• Stream IDs are properly assigned
• Interface names (e.g., napa0) match what you use in voipmonitor.conf

Troubleshooting: Napatech Drivers Not Capturing Traffic

If the VoIPmonitor sniffer is running but no calls are being captured, and you are using Napatech cards, the issue may be with the Napatech driver state. This can happen after driver crashes, system updates, or hardware resets.

Symptoms:

• VoIPmonitor GUI shows no calls (CDR list or Active Calls are empty)
• tshark -i napa0 shows no packets
• Napatech interfaces are UP but not receiving data
• Restarting only VoIPmonitor service does not resolve the issue

Solution:

Restart the Napatech drivers to reset the capture engine:

# Step 1: Stop VoIPmonitor sniffer service
systemctl stop voipmonitor

# Step 2: Navigate to Napatech binary directory
cd /opt/napatech3/bin/

# Step 3: Stop Napatech drivers
./ntstop

# Step 4: Start Napatech drivers
./ntstart

# Step 5: Restart VoIPmonitor sniffer service
systemctl start voipmonitor

If your system uses a different path for Napatech (e.g., /opt/napatech or /opt/napatech3), adjust the path in step 2 accordingly. You can locate the drivers with:

find /opt -name "ntstart" 2>/dev/null

Verification:

After restarting the drivers, verify that traffic is being captured:

# Check if packets are being captured on the Napatech interface
tshark -i napa0 -Y "sip || rtp" -n -c 10

# Verify VoIPmonitor is processing calls
tail -f /var/log/syslog | grep voipmonitor

If the issue persists after restarting the drivers, check the Napatech logs for error messages:

# View Napatech service logs
journalctl -u ntservice -n 50

# Or check log file if configured
tail -f /tmp/Log3G_*.log

Troubleshooting: Compilation Errors with DPDK Headers

If compilation fails when using Napatech drivers on a system that also has system DPDK libraries installed, you may encounter errors in dpdk.cpp such as:

error: 'RTE_ETH_MQ_TX_NONE' was not declared in this scope

This occurs because the system's package manager-installed DPDK libraries are conflicting with the specific DPDK headers included with the Napatech SDK. The compiler is mixing incompatible header versions.

Solution:

Disable DPDK support in the generated config.h file:

# Step 1: Run configure to generate config.h
./configure --with-dpdk-include=/opt/napatech3/include --with-dpdk-lib=/opt/napatech3/lib

# Step 2: Open config.h
# Location: config.h in the sniffer source directory

# Step 3: Disable DPDK support by either:
# Option A: Set HAVE_LIBDPDK to 0
# Change: #define HAVE_LIBDPDK 1
# To:     #define HAVE_LIBDPDK 0

# Option B: Comment out the entire block between:
# #ifdef HAVE_LIBDPDK and #endif

# Step 4: Save the file and compile
make

# Step 5: Verify compilation succeeded
ls -l voipmonitor

Note: Disabling DPDK support via config.h allows the Napatech card to function using the Napatech-provided libpcap library without requiring the DPDK-specific code. This is typically sufficient for most Napatech deployments that do not require the advanced DPDK polling mode.

Troubleshooting: Service Startup Order Issue (init.d only)

After a manual Git upgrade on a sensor with Napatech cards, the VoIPmonitor service may fail to start with the error libpcap error no such device exists. This occurs when the service startup order causes VoIPmonitor to start before the Napatech drivers are fully initialized.

This issue only affects systems using the traditional /etc/init.d/voipmonitor script. For systems using systemd, see below.

Solution for init.d systems:

Modify the /etc/init.d/voipmonitor script to ensure Napatech drivers are loaded before VoIPmonitor starts:

# Step 1: Open the init.d script
nano /etc/init.d/voipmonitor

# Step 2: In the start() section, add the Napatech driver start
# command BEFORE the command that launches voipmonitor
# Add these lines before the voipmonitor binary execution:

/opt/napatech3/bin/ntstart.sh
sleep 60

# The sleep command allows sufficient time for the
# Napatech drivers to fully initialize. You may need
# to adjust the value (e.g., 30, 45, 60 seconds) based
# on your hardware.

# Step 3: Save and close the script
# Step 4: Restart the voipmonitor service
service voipmonitor restart

Verification:

After applying the fix, check if VoIPmonitor starts correctly:

# Check service status
service voipmonitor status

# Check the logs for successful interface binding
tail -f /var/log/voipmonitor/voipmonitor.log | grep interface

# You should see a line like:
# "Listening on interface napa0" instead of an error

Troubleshooting: Git Upgrade Error with systemd

For systems using systemd instead of init.d scripts, the service startup order is managed differently. If you encounter libpcap error no such device exists after a Git upgrade with systemd:

See systemd service file configuration to ensure the service unit file includes:

After=ntservice.service
Requires=ntservice.service

This ensures the Napatech driver service (ntservice) is started before VoIPmonitor begins.

AI Summary for RAG

Summary: Instructions for building VoIPmonitor sniffer with Napatech support. Clone with git clone -b develop or switch branch with git checkout develop, then configure with --with-dpdk-include=/opt/napatech3/include --with-dpdk-lib=/opt/napatech3/lib and make. For GUI upgrades (v24.23+), set upgrade_by_git=yes and configure_param options. Includes ntpcap.ini, ntservice.ini config samples, time source configuration for correct timestamps, NTPL filtering, and troubleshooting for: spool directories with 1970-01-01 dates (set timeSource=OS), Napatech interfaces in DOWN state (requires custom libpcap), drivers not capturing traffic (restart with ntstop/ntstart commands), compilation errors with DPDK headers (edit config.h to set HAVE_LIBDPDK=0 when system DPDK libraries conflict with Napatech SDK), and service startup order issue after Git upgrade (modify /etc/init.d/voipmonitor to add /opt/napatech3/bin/ntstart.sh and sleep 60 before launching voipmonitor binary; for systemd use After=ntservice.service Requires=ntservice.service). Keywords: Napatech, compilation, git checkout develop, configure, upgrade_by_git, configure_param, ntpcap.ini, ntservice.ini, timeSource, 1970-01-01, timestamp, epoch time, NTPL filter, DOWN state, custom libpcap, interfaces, troubleshooting, ntstop, ntstart, no calls captured, driver restart, rte_eth_mq_tx_none, config.h, dpdk.cpp, HAVE_LIBDPDK, service startup order, init.d, libpcap error no such device exists, git upgrade, ntstart.sh, sleep, systemd, After=ntservice.service Key Questions:

• How do I compile VoIPmonitor with Napatech support?
• How do I switch to the develop branch?
• What configure options are needed for Napatech?
• Napatech interfaces are in DOWN state, how do I fix it?
• Why is tcpdump showing no packets on Napatech interfaces?
• How do I verify voipmonitor is using Napatech libpcap?
• VoIPmonitor not capturing calls with Napatech, how do I restart the drivers?
• What do I do when ntstop or ntstart are located?
• How do I fix RTE_ETH_MQ_TX_NONE compilation error when building with Napatech?
• What do I do if system DPDK libraries conflict with Napatech SDK?
• VoIPmonitor service fails to start with libpcap error no such device exists after Git upgrade, how do I fix it?
• How to fix Napatech service startup order issue with init.d script?
• Do I need to add sleep after ntstart.sh in voipmonitor init script?
• How to configure Napatech driver dependency in systemd?
• What does libpcap error no such device exists mean with Napatech cards?