Use a valid DANZ Monitoring Fabric (DMF) Controller username and password to authenticate with a DMF Recorder Node over its REST API. The recorder node delegates authentication to the DMF Controller. If the username and password provided are valid, the recorder node authorizes the user for the invoked recorder node REST endpoint.

$ curl https://1.2.3.4/query/window -u admin:12345 -k | python -m json.tool
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 79 100 79 0 0 143 0 --:--:-- --:--:-- --:--:-- 143
{
"begin": "2019-01-23 15:15:23 +0000 UTC",
"end": "2019-02-04 17:39:52 +0000 UTC"
}

In this example, the recorder node IP address is 1.2.3.4. The username on the DMF Controller is admin, and the password is 12345.

/ready

• Description: Is the DANZ Monitoring Fabric (DMF) Recorder Node able to accept queries? Return payload indicates progress towards start up completion.
• HTTP Method: GET
• Request Payload:
• Return MIME Type:
• Return Payload:

  {
  "current-value": <int>,
  "max-value": <int>,
  "percent-complete": <float>
  }

• Return Status Code:
  • 200, ready
  • 503, not ready

/query/window

• Description: Get timestamp of oldest and newest packet available for query.
• HTTP Method: GET
• Request Payload:
• Return MIME Type: application/json
• Return Payload:

  {
  "begin" : <RFC-3339>,
  "end" : <RFC-3339>
  }

• Return Status Code:
  • 200, success
  • 400, input error
  • 500, internal error
  • 503, not ready

/query/size

• Description: Get count and aggregate size of packets matching provided filter.
• HTTP Method: POST
• Request Payload: Stenographer query string
• Return MIME Type: application/json
• Return Payload:

  {
  "packet-count" : <int>,
  "aggregate-size" : <int>
  }

• Return Status Code:
  • 200, success 400, input error
  • 500, internal error
  • 503, not ready

/query/application

• Description: Perform DPI on packets matching provided filter. DPI is performed using nDPI.
• HTTP Method: POST
• Request Payload: Stenographer query string
• Return MIME Type: application/json
• Return Payload: Defined by nDPI
• Return Status Code:
  • 200, success
  • 400, input error
  • 500, internal error
  • 503, not ready

/query/packet

• Description: Download pcap of packets matching provided filter.
• HTTP Method: POST
• Request Payload: Stenographer query string
• Return MIME Type: application/vnd.tcpdump.pcap
• Return Payload: .pcap file
• Return Status Code:
  • 200, success
  • 400, input error
  • 500, internal error
  • 503, not ready

/query/analysis[filter="<stenographer-query-string>"][type ="<analysis-type>"]

• Description: Perform an analysis on the packets matching the stenographer query string. Supported values for analysis-type are:
  • analysis_http_tree
  • analysis_http_stat
  • analysis_http_req_tree
  • analysis_http_srv_tree
  • analysis_dns_tree
  • analysis_hosts
  • analysis_conv_ipv4
  • analysis_conv_ipv6
  • analysis_conv_tcp
  • analysis_conv_udp
  • analysis_rtp_streams
  • analysis_sip_stat
  • analysis_conv_sip
  • analysis_tcp_packets
  • analysis_tcp_flow_health
• HTTP Method: GET
• Request Payload:
• Return MIME Type: application/json
• Return Payload: Determined by the analysis type selected.
• Return Status Code:
  • 200, success
  • 400, input error
  • 500, internal error
  • 503, not ready

/query/replay/request[filter="<stenographer-query-string>"][real-time="<boolean>"]

• Description: Asynchronously request packets matching filter be replayed into the monitoring fabric. Replay is performed using tcp replay.
• HTTP Method: POST
• Request Payload:
• Return MIME Type: application/json
• Return Payload:

  {
  "id" : <int>,
  "message": <string>
  }

• Return Status Code:
  • 200, success
  • 400, input error
  • 500, internal error
  • 503, not ready

/query/replay/request[filter="<stenographer-query-string>"][speed-mbps="<int>"]

• Description: Asynchronously request packets matching filter be replayed into the monitoring fabric. Replay is performed using tcp replay.
• HTTP Method: POST
• Request Payload:
• Return MIME Type: application/json
• Return Payload:

  {
  "id" : <int>,
  "message": <string>
  }

• Return Status Code:
  • 200, success
  • 400, input error
  • 500, internal error
  • 503, not ready

/query/replay/done

• Description: Check the status of a replay matching the provided ID. Message contains replay result from tcp replay.
• HTTP Method: POST
• Request Payload: Replay ID
• Return MIME Type: application/json
• Return Payload:

  {
  "id" : <int>,
  "done" : <boolean>,
  "message": <string>
  }

• Return Status Code:
  • 200, success
  • 400, input error
  • 404, replay ID unknown
  • 406, replay not done
  • 500, internal error
  • 503, not ready

/erase/packet[filter="<stenographer-query-string>"]

• Description: Erase packets matching the provided filter. Note that any packet not matching the filter but in the same packet file of a packet matching the filter will also be deleted.
• HTTP Method: POST
• Request Payload:
• Return MIME Type: application/json
• Return Payload:

  {
  "bytes-erased" : <int>,
  "message" : <string>
  }

• Return Status Code:
  • 200, success
  • 400, input error
  • 500, internal error
  • 503, not ready

/event/update[trigger="<boolean>"][name="<string>"][pre-buffer-minutes="<int>"]

• Description: Trigger or terminate the named event. Set pre-buffer-minutes to 0 to use the available pre-buffer.
• HTTP Method: POST
• Request Payload:
• Return MIME Type: application/json
• Return Payload:

  {
  "message" : <string>,
  "event-queued" : <boolean>
  }

• Return Status Code:
  • 200, success
  • 400, input error
  • 500, internal error
  • 503, not ready

/abort/query

• Description: Terminate a particular query defined by the provided Stenographer query string.
• HTTP Method: POST
• Request Payload:
• Return MIME Type: application/json
• Return Payload:

  {
  "message" : <string>
  }

• Return Status Code:
  • 200, success
  • 400, input error
  • 500, internal error
  • 503, not ready

/abort-all/query

• Description: Terminate all running queries.
• HTTP Method: POST
• Request Payload:
• Return MIME Type: application/json
• Return Payload:

  {
  "message" : <string>
  }

• Return Status Code:
  • 200, success
  • 400, input error
  • 500, internal error
  • 503, not ready

/queries

• Description: Determine the currently running queries, enumerated by the Stenographer query string of the query.
• HTTP Method: GET
• Request Payload:
• Return MIME Type: application/json
• Return Payload:

  {
  "queries" : [
  <stenographer-query-string>, ...
  ]
  }

• Return Status Code:
  • 200, success
  • 400, input error
  • 500, internal error
  • 503, not ready

/status/query

• Description: Determine how far a given query has progressed. This can be used to estimate the time remaining to run the query.
• HTTP Method: GET
• Request Payload:
• Return MIME Type: application/json
• Return Payload:

  {
  "query" : <stenographer-query-string>, "current-value" : <int>,
  "max-value" : <int>, "percent-complete" : <float>
  }

• Return Status Code:
  • 200, success
  • 400, input error
  • 500, internal error
  • 503, not ready

/status/all

• Description: Determine how far all queries have progressed. This can be used to estimate the time remaining to run the queries.
• HTTP Method: GET
• Request Payload:
• Return MIME Type: application/json
• Return Payload:

  {
  "queries" : [
  {
  "query" : <stenographer-query-string>,
  "current-value" : <int>,
  "max-value" : <int>,
  "percent-complete" : <float>
  },
  ...
  ]
  }

• • Return Status Code:
    • 200, success
    • 400, input error
    • 500, internal error
    • 503, not ready