» azurerm_packet_capture
Configures Network Packet Capturing against a Virtual Machine using a Network Watcher.
» Example Usage
resource "azurerm_resource_group" "test" {
name = "packet-capture-rg"
location = "West Europe"
}
resource "azurerm_network_watcher" "test" {
name = "network-watcher"
location = "${azurerm_resource_group.test.location}"
resource_group_name = "${azurerm_resource_group.test.name}"
}
resource "azurerm_virtual_network" "test" {
name = "production-network"
address_space = ["10.0.0.0/16"]
location = "${azurerm_resource_group.test.location}"
resource_group_name = "${azurerm_resource_group.test.name}"
}
resource "azurerm_subnet" "test" {
name = "internal"
resource_group_name = "${azurerm_resource_group.test.name}"
virtual_network_name = "${azurerm_virtual_network.test.name}"
address_prefix = "10.0.2.0/24"
}
resource "azurerm_network_interface" "test" {
name = "pctest-nic"
location = "${azurerm_resource_group.test.location}"
resource_group_name = "${azurerm_resource_group.test.name}"
ip_configuration {
name = "testconfiguration1"
subnet_id = "${azurerm_subnet.test.id}"
private_ip_address_allocation = "Dynamic"
}
}
resource "azurerm_virtual_machine" "test" {
name = "pctest-vm"
location = "${azurerm_resource_group.test.location}"
resource_group_name = "${azurerm_resource_group.test.name}"
network_interface_ids = ["${azurerm_network_interface.test.id}"]
vm_size = "Standard_F2"
storage_image_reference {
publisher = "Canonical"
offer = "UbuntuServer"
sku = "16.04-LTS"
version = "latest"
}
storage_os_disk {
name = "osdisk"
caching = "ReadWrite"
create_option = "FromImage"
managed_disk_type = "Standard_LRS"
}
os_profile {
computer_name = "pctest-vm"
admin_username = "testadmin"
admin_password = "Password1234!"
}
os_profile_linux_config {
disable_password_authentication = false
}
}
resource "azurerm_virtual_machine_extension" "test" {
name = "network-watcher"
location = "${azurerm_resource_group.test.location}"
resource_group_name = "${azurerm_resource_group.test.name}"
virtual_machine_name = "${azurerm_virtual_machine.test.name}"
publisher = "Microsoft.Azure.NetworkWatcher"
type = "NetworkWatcherAgentLinux"
type_handler_version = "1.4"
auto_upgrade_minor_version = true
}
resource "azurerm_storage_account" "test" {
name = "pctestsa"
resource_group_name = "${azurerm_resource_group.test.name}"
location = "${azurerm_resource_group.test.location}"
account_tier = "Standard"
account_replication_type = "LRS"
}
resource "azurerm_network_packet_capture" "test" {
name = "pctestcapture"
network_watcher_name = "${azurerm_network_watcher.test.name}"
resource_group_name = "${azurerm_resource_group.test.name}"
target_resource_id = "${azurerm_virtual_machine.test.id}"
storage_location {
storage_account_id = "${azurerm_storage_account.test.id}"
}
depends_on = ["azurerm_virtual_machine_extension.test"]
}
NOTE: This Resource requires that the Network Watcher Virtual Machine Extension is installed on the Virtual Machine before capturing can be enabled which can be installed via the azurerm_virtual_machine_extension
resource.
» Argument Reference
The following arguments are supported:
-
name
- (Required) The name to use for this Network Packet Capture. Changing this forces a new resource to be created. -
network_watcher_name
- (Required) The name of the Network Watcher. Changing this forces a new resource to be created. -
resource_group_name
- (Required) The name of the resource group in which the Network Watcher exists. Changing this forces a new resource to be created. -
target_resource_id
- (Required) The ID of the Resource to capture packets from. Changing this forces a new resource to be created.
NOTE: Currently only Virtual Machines ID's are supported.
-
maximum_bytes_per_packet
- (Optional) The number of bytes captured per packet. The remaining bytes are truncated. Defaults to0
(Entire Packet Captured). Changing this forces a new resource to be created. -
maximum_bytes_per_session
- (Optional) Maximum size of the capture in Bytes. Defaults to1073741824
(1GB). Changing this forces a new resource to be created. -
maximum_capture_duration
- (Optional) The maximum duration of the capture session in seconds. Defaults to18000
(5 hours). Changing this forces a new resource to be created. -
storage_location
- (Required) Astorage_location
block as defined below. Changing this forces a new resource to be created. -
filter
- (Optional) One or morefilter
blocks as defined below. Changing this forces a new resource to be created.
A storage_location
block contains:
-
file_path
- (Optional) A valid local path on the targeting VM. Must include the name of the capture file (*.cap). For linux virtual machine it must start with/var/captures
. -
storage_account_id
- (Optional) The ID of the storage account to save the packet capture session
NOTE: At least one of file_path
or storage_account_id
must be specified.
A filter
block contains:
-
local_ip_address
- (Optional) The local IP Address to be filtered on. Notation: "127.0.0.1" for single address entry. "127.0.0.1-127.0.0.255" for range. "127.0.0.1;127.0.0.5" for multiple entries. Multiple ranges not currently supported. Mixing ranges with multiple entries not currently supported. Changing this forces a new resource to be created. -
local_port
- (Optional) The local port to be filtered on. Notation: "80" for single port entry."80-85" for range. "80;443;" for multiple entries. Multiple ranges not currently supported. Mixing ranges with multiple entries not currently supported. Changing this forces a new resource to be created. -
protocol
- (Required) The Protocol to be filtered on. Possible values includeAny
,TCP
andUDP
. Changing this forces a new resource to be created. -
remote_ip_address
- (Optional) The remote IP Address to be filtered on. Notation: "127.0.0.1" for single address entry. "127.0.0.1-127.0.0.255" for range. "127.0.0.1;127.0.0.5;" for multiple entries. Multiple ranges not currently supported. Mixing ranges with multiple entries not currently supported.. Changing this forces a new resource to be created. -
remote_port
- (Optional) The remote port to be filtered on. Notation: "80" for single port entry."80-85" for range. "80;443;" for multiple entries. Multiple ranges not currently supported. Mixing ranges with multiple entries not currently supported. Changing this forces a new resource to be created.
» Attributes Reference
The following attributes are exported:
-
id
- The Packet Capture ID. -
storage_location
- (Required) Astorage_location
block as defined below.
A storage_location
block contains:
-
storage_path
- The URI of the storage path to save the packet capture.
» Import
Packet Captures can be imported using the resource id
, e.g.
terraform import azurerm_network_packet_capture.capture1 /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/mygroup1/providers/Microsoft.Network/networkWatchers/watcher1/packetCaptures/capture1